MCP Security Flaws Mount as Agent Protocol Adoption Explodes

A protocol that grew faster than its defenses

The Model Context Protocol (MCP), the open standard Anthropic created to connect AI agents to external tools and data, has become core infrastructure for agentic AI. That shift happened quickly. OpenAI adopted MCP in March 2025 and later brought it into ChatGPT apps. Anthropic donated the protocol to the Agentic AI Foundation under the Linux Foundation in December 2025 5. By mid-2026, more than 10,000 MCP servers were reportedly running in production, and the SDKs were being downloaded over 97 million times a month. Salesforce alone reported 4.5 million MCP calls through its Headless 360 platform within weeks of launch 5.

Security researchers have been working just as fast. Reports published this spring and summer describe a protocol with weaknesses in its core design and in how it is deployed.

The unpatched STDIO flaw

The most serious disclosure came from OX Security in April 2026. It concerns MCP's STDIO transport, which executes operating system commands without sanitization or validation. That opens a path to remote code execution on vulnerable hosts 2. The Cloud Security Alliance estimates about 200,000 exposed instances across a supply chain of more than 150 million package downloads 2. According to one tracker, the flaw affects every official SDK and remains unpatched because Anthropic considers the behavior expected 1.

Some downstream projects have issued their own fixes. LiteLLM and Bisheng/Jaaz, for example, received CVEs that are now patched 1. Fixing this one integration at a time leaves the underlying design unchanged, so each new project built on the SDKs can inherit the same exposure.

How many CVEs? It depends on who's counting

The vulnerability counts vary widely between sources, mostly because they measure different things.

• Cloud Security Alliance: counted at least seven confirmed high- or critical-severity CVEs as of May 2026. These span MCP Inspector, LiteLLM, Cursor IDE, LibreChat and Windsurf, with more under tracking 2.
• VIPER-MCP: an automated sweep of roughly 40,000 server repositories that produced 67 CVEs 3.
• Akamai: reported three flaws in database-focused MCP servers, one still unpatched 3.
• Authentication study: traced nine CVEs to broken OAuth flows 3.

The CSA's smaller figure reflects severity and platform prominence. The larger tallies reflect breadth across the long tail of community servers. Either way, the count is growing rather than leveling off.

Exposure and authentication

Exposure figures also vary by methodology:

• Trend Micro first found 492 internet-facing MCP servers with no authentication 4.
• A later Trend Micro scan counted 1,467 exposed servers. It also found CVSS 9.8 command-injection bugs in unofficial AWS and Azure MCP servers, a sign the problem now extends from local setups into the cloud 3.
• A June roundup cited 12,520 exposed servers in total 3.

The authentication finding is more consistent. The first large-scale measurement of remote MCP servers found roughly 40% expose their tools with no authentication at all 3. Scans attributed to Wiz, Bloomberry and Censys put the figure at 38–40% 1. Session hijacking, once treated as a deployment mistake, is now described as a bug shipped inside the official SDKs 1.

Attacks the spec doesn't address

Beyond code execution, the CSA notes that the MCP specification has no native defenses against three attack classes, all now seen in real incidents [2]:

• Tool poisoning: malicious instructions hidden in tool definitions.
• Rug pulls: a tool's behavior changes after it has been approved.
• Cross-server tool shadowing: one server's tools impersonate or interfere with another's.

Tenet Security's "agentjacking" research showed how fragile model-level guardrails are against these. The attack succeeded in 85% of tested cases even when the agent had explicit instructions to resist injection 1.

A supply-chain problem first

The wider incident record supports treating MCP as a dependency risk. Check Point found remote code execution in Claude Code through poisoned repository config files. Antiy CERT confirmed 1,184 malicious skills on ClawHub, the marketplace for the OpenClaw agent framework 4. One analysis argues that AI agent security in 2026 is a supply chain problem first and a prompt injection problem second, with MCP as the common element across the year's major incidents 4. The same report notes that the Pentagon designated Anthropic a "supply chain risk," reportedly a first for an American company 4. Guidance is also arriving from government: the NSA has published design considerations for hardening MCP 3.

Reading the situation

The evidence points to a structural problem more than a run of bad luck. MCP was built for easy connectivity, and its fast adoption locked in defaults that put the security burden on implementers. Many implementers have not taken it on, as the roughly 40% of servers without authentication shows.

Now that MCP sits under neutral Linux Foundation governance, the key question is whether the specification will add protections against command execution and tool tampering. Until it does, organizations deploying MCP should treat every server as untrusted third-party code. That means requiring authentication, sandboxing STDIO execution and pinning tool definitions, rather than relying on model guardrails that agentjacking has shown can be bypassed.