Topic
The field of securing Model Context Protocol (MCP) servers and clients against auth flaws, injection attacks, and unsafe command execution.
In a post on aminrj.com, an OWASP working-group member says CVEs fit only two of six places where AI agent and MCP flaws live. Over-broad permissions, shared service accounts and confused-deputy designs sit in the other four, where a scanner has nothing to flag.
Reality
Pennyforge's dated scan of the 20 most-starred MCP servers found 41 behavior-steering phrases in tool descriptions across eight repositories. Teams wiring these servers into agents now have quoted lines and a repeatable method to hold up against the NSA's May warning on MCP security.
Reality
Syed Anas Mohiuddin found the same SSRF flaw in MCP servers from five unrelated organisations, including Google, JPMorgan and two governments. Each server turned an address supplied through an agent into an outbound request without checking where it resolved, and any team running its own tool servers can check for the same gap.
Reality
MCP Atlassian releases before 0.22.0 fall back to the operator's credentials whenever an HTTP caller has no verified identity (CVE-2026-77244). HTTP deployments need the upgrade, and the endpoint should be reachable only through a management network or an authenticating proxy.
Reality
MCP Python SDK maintainers rated a flaw that let a connected server choose where OAuth secrets were sent High, at 7.5. For its two machine-to-machine providers, upgrading changes nothing until the client names the issuer it expects.
Reality
AWS published CVE-2026-87911, a CVSS 9.6 command injection in its own postgres-mcp-server, where one COPY ... TO PROGRAM line runs a shell on the host. The read-only promise lives in a regex filter that lets the COPY keyword through.
Reality
MCP Python SDK releases 1.30.0 and 2.2.0 leave a credential-theft bug open for two OAuth providers unless their constructors pass an issuer. For unattended MCP clients the fix is a one-argument code change, and each team has to find and make it in its own source.
Reality
Model Context Protocol's reference Postgres MCP server guards writes with a read-only transaction. One COMMIT; DROP TABLE query drops the table anyway. Only database permissions sit where the agent's SQL cannot reach.
Reality
LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
Reality
Imperva found Microsoft's DebugMCP 1.1.4 let a malicious webpage run code on a developer's machine through an unauthenticated port 3001 listener. The fix reached 1.2.0 with no advisory, so finding exposed machines means checking installed extension versions.
Reality
MCP servers that skip audience binding accept tokens minted for other servers, says a dev.to OAuth 2.1 guide that puts it in the 80% most guides skip. The check depends on RFC 9728 metadata the server publishes and a resource parameter the client sends.
Reality
A GET asks a site for a page and a POST tells it to act, so the change Akamai measured over 30 days puts verified AI bots on the request type behind store logins, carts and checkouts. Akamai did not break those requests down by action; retailers have that in their own logs.
Reality
Hush Security searched public GitHub for the configuration filenames coding agents write, classified how each credential slot gets its value, and found a hardcoded literal in 12% of them, most of which match no vendor token format.
Reality
A dev.to post argues MCP's attack surface follows from point-to-point model-to-server links and belongs behind an inline gateway. The tool-poisoning path it documents runs through description text that a gateway may forward unchanged.
Reality
In MCP's Sampling flow the server composes the prompt and the client runs the completion on its own model. The includeContext default is "none", and the two wider values only work if the client declares a capability.
Reality
Island scanned 475,865 tools across 33,563 MCP server builds in July 2026 and found manipulation signals in 3.3% of them. Its researcher says a scan can confirm the capability is there without seeing what will actually run.
Reality
The poisoned field is inputSchema, which the framework parses and executes against while the model's safety training never evaluates it, so the only gate that holds is a hash recomputed at every call.
Reality
An SC World commentary argues the AI security debate is stuck on model behavior while agent connectors get wired with API keys that never rotate and model loading still executes unsigned code.
Reality
The MCP layer inherits its trust at install time and never re-checks it, so a lapsed domain behind a still-listed registry entry belongs to whoever registers it next. Air Security says it registered one, and agents came.
Reality
A researcher found the SSRF guard sitting on the credential-submission side of an MCP auth SDK while the .well-known discovery fetch ran unchecked from the public entry point, which is the wrong end of the flow to protect.
Reality