The Model Context Protocol (MCP), introduced by Anthropic in late 2024 as a universal standard for connecting AI assistants to external tools and data sources, became a significant attack surface in 2026. Security researchers disclosed over 40 CVEs against MCP implementations, found hundreds of servers exposed to the public internet without authentication, and documented new attack classes including tool poisoning.

What is MCP

MCP provides a standardized way for AI agents to discover, invoke, and receive results from external tools. Instead of each AI provider building custom integrations for every service, MCP defines a protocol that any tool provider can implement and any AI client can consume.

The protocol prioritizes developer flexibility: agents can dynamically discover new tools, read tool descriptions, and invoke them with structured parameters. This flexibility became the security problem.

The CVE count

Between January and April 2026, researchers disclosed more than 40 CVEs against MCP implementations across Python, TypeScript, Java, and Rust SDKs (Microsoft, 2026 ).

Trend Micro found 492 MCP servers exposed to the public internet with zero authentication, offering direct access to 1,402 tools, with 90% allowing read access (Medium, citing Trend Micro 2026 ).

A 2026 audit summarized by API gateway vendor Zuplo found:

  • 40% of MCP servers require no authentication
  • 43% carry command-injection vulnerabilities
  • 79% handle credentials in plaintext

(Codersera, 2026 )

Tool poisoning

Tool poisoning emerged as the signature MCP attack. Malicious instructions are hidden in a tool’s description or schema that the model reads but the user mostly ignores.

Microsoft describes the mechanism: “Anyone who can plant instructions in any of those can steer the agent. Tool poisoning is the sharp edge—malicious instructions hidden in a tool’s description or schema that the model reads and the user mostly ignores” (Microsoft, 2026 ).

An attacker does not need to compromise the MCP server itself. They can:

  1. Create a legitimate-looking tool with a poisoned description
  2. Get the tool listed in a tool registry the agent queries
  3. The agent reads the description, follows the embedded instructions, and performs unintended actions

Vulnerable by default

AgentsID’s state-of-agent-security analysis concluded that MCP is vulnerable by default: “The protocol prioritizes developer flexibility over the schema strictness and semantic validation required for safe autonomous operation, and its own reference implementations confirm that insecurity is the path of least resistance” (AgentsID, 2025 ).

The academic paper “Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning” (MDPI, 2026) documented that while MCP simplifies integration between AI applications and services, it introduces significant security vulnerabilities, particularly on the client side (MDPI, 2026 ).

Common vulnerability classes

CYFIRMA’s threat research documented the attack surface: “An AI agent operating through MCP does not connect to one external system. It connects to many. What threat actors identified, and what this report documents in detail, is that the same architectural properties that make MCP powerful make it dangerous when adversaries gain a foothold” (CYFIRMA, 2026 ).

The most common MCP vulnerabilities:

VulnerabilityImpact
No authenticationAnyone can invoke tools
Credential exposureLeaked keys, secrets in plaintext
Command injectionAttacker-controlled input reaches shell
Tool poisoningMalicious instructions in tool descriptions
Insecure transportNo TLS, traffic interception possible

Ostering’s threat model notes the mundane reality: “The most common MCP problem in the wild is mundane, not exotic: credential and token exposure (leaked keys, broad shared tokens, secrets in plaintext), not clever prompt injection” (Ostering, 2026 ).

Why it matters for builders

MCP adoption is accelerating. If you are building or consuming MCP integrations:

  1. Assume tool descriptions are untrusted input that can contain injected instructions
  2. Require authentication on all MCP servers, even internal ones
  3. Use TLS or mTLS for all MCP communication
  4. Validate and sanitize tool inputs before execution
  5. Audit which tools your agent can access and apply least privilege
  6. Monitor for anomalous tool invocations in production

The protocol’s flexibility is a feature for developers and a vulnerability for security. Until MCP matures with stricter defaults, the burden is on implementers to secure their deployments.

Sources

  1. Microsoft. “The state of MCP security in 2026.” Microsoft Security Blog. https://techcommunity.microsoft.com/blog/microsoft-security-blog/the-state-of-mcp-security-in-2026/4531327
  2. MDPI. “Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning.” (2026). https://www.mdpi.com/2624-800X/6/3/84/xml
  3. CYFIRMA. “Exploitation of Model Context Protocol in Agentic AI Deployments.” (2026). https://www.cyfirma.com/research/exploitation-of-model-context-protocol-in-agentic-ai-deployments/
  4. UVCyber. “Threat Advisory: MCP Threats.” https://www.uvcyber.com/resources/reports/threat-advisory-mcp-threats
  5. Codersera. “How to Secure MCP Servers (2026 Guide).” https://codersera.com/blog/how-to-secure-mcp-servers-2026/amp/
  6. AgentsID. “State of Agent Security 2026.” https://github.com/AgentsID-dev/agentsid-scanner/blob/master/docs/state-of-agent-security-2026.md