MCP Security: NSA Warns AI Agent Protocol Outpaced Its Defenses

A standard that grew faster than its guardrails

The Model Context Protocol (MCP) has become plumbing for the agentic AI era. It moved data and triggered actions between models and the tools they call, and it did so faster than almost anyone expected. Now the U.S. National Security Agency has put a blunt assessment on the record: MCP's rapid proliferation "has outpaced the development of its security model." 12

The NSA's security design guidance describes MCP as a mechanism for automating data sharing and task execution across AI-driven workflows. Those workflows include model evaluation, enrichment, preprocessing, and general task automation. 1 The agency notes that the protocol is no longer confined to experiments. It runs in production deployments across business, finance, legal, and software development. It names AutoGen Studio, Harvey AI, Agentverse, and Copilot as examples of products built on it. 1

From side project to industry backbone

The scale of that adoption explains why a signals-intelligence agency is weighing in on a developer protocol. In roughly two years, MCP went from an Anthropic side project to a standard governed by the Linux Foundation. It now has backing from OpenAI, Google, and Microsoft and more than 97 million monthly SDK downloads. 2 AuthZed's analysis places the NSA warning in a report issued in May 2026. It frames the moment as a turning point: the interesting question is no longer how fast MCP is spreading but how much security debt has piled up along the way. 2

The two accounts agree on the core diagnosis. They differ mainly in emphasis. The NSA document reads as design guidance, explaining what MCP is, where it lives, and why its security model lags. 1 AuthZed's coverage is an inventory of the damage. It catalogs vulnerabilities, incident reports, and scan results that make the abstract warning concrete. 2

What the security debt looks like

The numbers are stark. Independent scans cited by AuthZed find exploitable flaws in somewhere between 30% and 82% of public MCP servers. 2 That range is wide, which suggests scanning methods and definitions of "exploitable" differ considerably. Even the low end, though, would mean nearly a third of exposed servers are vulnerable.

Specific vulnerabilities underline the severity:

• CVE-2025-6514, a remote code execution flaw in mcp-remote rated CVSS 9.6. 2
• CVE-2025-49596, a remote code execution bug in the MCP Inspector tool. 2

Authentication may be the most telling figure. Only 8.5% of servers reportedly use OAuth. 2 Most of the ecosystem, in other words, is not using the standard, well-understood mechanism for delegated authorization. That leaves agents and the tools they invoke to rely on weaker or ad hoc controls.

The documented incidents from April through late 2025 cover several distinct failure modes. 2 They include a supply-chain backdoor in the postmark-mcp package and a cross-tenant data leak involving Asana. They also include prompt-injection attacks that pulled data through GitHub and WhatsApp integrations. 2 Each represents a different class of risk: compromised dependencies, broken isolation between customers, and models manipulated by untrusted content into exfiltrating information.

Why this matters

MCP's value comes from connecting models to real systems: files, repositories, messaging, and business applications. That same connectivity is what makes its weaknesses dangerous. A flaw in a chatbot might produce a bad answer. A flaw in an agent wired to production tools can execute code, leak another tenant's records, or ship sensitive data to an attacker. Because the NSA lists regulated sectors such as finance and legal among MCP's adopters, the stakes extend beyond developer sandboxes. 1

The incident list also shows that no single fix will close the gap. Patching individual CVEs addresses implementation bugs. It does not address supply-chain trust, tenant isolation, or prompt injection, which is arguably a design-level problem in how agents treat external content.

The takeaway

MCP's adoption curve is not the alarming part. The low OAuth uptake and the variety of real-world exploits are. With a national security agency now formally flagging the protocol's security model as lagging, and with heavyweight vendors and a foundation steering its governance, pressure for stronger defaults seems likely to grow. 12

For organizations running MCP today, the practical reading is straightforward:

• Treat MCP servers as privileged infrastructure.
• Insist on proper authorization.
• Vet dependencies.
• Assume any content an agent reads could be hostile.

The protocol won the standards race. Securing it is the next contest, and on current evidence it is well behind schedule.