MCP Security: Adoption Outpaced Defenses in AI Agent Protocol

From side project to plumbing

When Anthropic open-sourced the Model Context Protocol in late November 2024, it pitched MCP as an open standard for building "secure, two-way connections" between AI tools and the places data actually lives: content repositories, business software, and development environments. 5 The launch was modest. It included a spec and SDKs, local server support in Claude Desktop, and a handful of prebuilt servers for systems like Google Drive, Slack, GitHub, and Postgres. 5

What followed was one of the fastest standardization stories in recent software history. OpenAI adopted MCP across its Agents SDK, Responses API, and ChatGPT desktop in March 2025. Google DeepMind confirmed Gemini support in April. 1 A November 2025 spec revision added asynchronous operations, statelessness, server identity, and an official registry for discovering servers. In December, Anthropic handed the protocol to the new Agentic AI Foundation under the Linux Foundation. 12

The adoption figures vary depending on who is counting and what they measure. One industry guide reports server downloads rising from roughly 100,000 at launch to more than 8 million by April 2025. The same guide cites over 5,800 servers, 300-plus clients, and more than 97 million monthly SDK downloads within a year. 2 It names Block, Bloomberg, and Amazon among enterprise deployments. 2 These are different metrics from different vantage points and shouldn't be read as a single tidy curve. The direction is unambiguous, though: MCP became the default way to wire AI agents into tools.

The bill comes due

Security researchers now argue that this speed came at a cost. The Cloud Security Alliance's research arm calls MCP one of the most rapidly weaponized attack surfaces in agentic AI. 4 It points to a systemic flaw disclosed by OX Security in April 2026. The CSA estimates the flaw affects about 200,000 vulnerable instances across a supply chain of more than 150 million package downloads. 4

The core problem, according to that analysis, sits in MCP's STDIO transport. It reportedly executes operating-system commands without sanitization or validation, which opens the door to remote code execution on affected hosts. 4 The same report says that by May 2026 at least seven high- or critical-severity CVEs had been confirmed across MCP-integrated platforms, with more under active tracking. Named platforms include MCP Inspector, LiteLLM, Cursor IDE, LibreChat, and Windsurf. 4

The CSA's broader critique is that the specification itself offers no native defenses against several related attack classes. 4 These include:

• Tool poisoning, where malicious instructions are hidden in a tool's description.
• Rug pulls, where a tool changes its behavior after a user has trusted it.
• Cross-server tool shadowing, where one server interferes with another's tools. 4

Checkmarx's overview covers similar ground from a defender's angle. It catalogs prompt injection through data sources such as tickets and files. 3 It also flags compromised servers acting as bridges for lateral movement into internal databases, and weakly configured servers that leak API keys stored in their configs. 3 Its recommended mitigations are conventional but telling: require user confirmation for actions and restrict tool permissions. 3

Where the accounts diverge

The celebratory retrospectives and the security write-ups describe the same protocol, but they emphasize different things. The adoption-focused accounts treat Linux Foundation governance and the November spec additions, including server identity, as signs of maturity. 12 One enterprise guide does mention security risks, but frames them as an implementation concern rather than a defining feature. 2 The CSA analysis frames the problems as architectural, baked into the protocol's design rather than introduced by careless implementers. 4 Checkmarx sits between the two. It treats the risks as serious but manageable with the right controls. 3

These positions aren't strictly contradictory. Hardening features can arrive while earlier design choices remain exploitable in the wild, especially across hundreds of thousands of deployments that may never be updated.

Reading the situation

The most defensible interpretation is that MCP followed a familiar pattern. Ease of use drove adoption, and that same ease of use widened the attack surface. Anthropic's launch even highlighted how quickly a model could generate new MCP server implementations. 5 That was a feature for growth, but it also means a long tail of servers written fast and audited rarely.

The shift to foundation governance creates an opportunity to treat security as a spec-level concern rather than leaving it to each vendor. Whether that happens is an open question. For now, the practical takeaway for organizations is that connecting an agent to an MCP server deserves the same scrutiny as installing any third-party package with shell access. In the worst cases documented so far, that is effectively what it is. 4