MCP Server Security: Fuzzer Finds 253 Bugs in AI Agent Tools

Researchers have reported 253 verified security bugs across 343 AI agent tools in 118 open-source Model Context Protocol (MCP) servers 12. The core problem is how these servers handle arguments written by large language models. As MCP becomes a common way to connect autonomous agents to files, networks and system commands, the study suggests that much of the code on the receiving end treats model-generated input with too much trust.

What the researchers found

The bugs surfaced during an evaluation of ToFu, a tool-aware fuzzing framework 2. It is built to catch security violations that traditional fuzzers miss because those fuzzers mostly watch for crashes 2. The distinction matters. A path-traversal flaw or a log-injection bug usually doesn't crash anything. The server keeps running while it does something it shouldn't.

The pool of targets was large. It included 273 reachable MCP servers and 3,405 extracted tools, though the team could only exercise a subset 2. Fuzzing first produced 508 candidate bugs. Manual review then removed 103 findings judged non-vulnerable and 152 duplicates, leaving the 253 confirmed issues 2.

The confirmed bugs break down as follows [2]:

• 115 reflected-output bugs
• 64 path-traversal flaws
• 58 log-injection issues
• 7 server-side request forgery (SSRF) vulnerabilities
• 5 data-exfiltration bugs
• 3 operating-system command-injection flaws
• 1 leftover temporary-file issue

The researchers add a caveat about the largest category. Reflected output does not automatically amount to exploitable cross-site scripting. Whether it causes harm depends on whether downstream software renders the content unsafely 2.

Why LLM-generated arguments are a distinct risk

The study's main point is about where the trust boundary sits 1. In conventional software, developers learn to distrust user input. In an agent architecture, the input reaching a tool comes from a model. The model is shaped by prompts, retrieved documents, web pages and other content that an attacker may control.

When an MCP server takes a file path or URL from the model and passes it straight to the filesystem or an HTTP client, that is the opening that path traversal and SSRF exploit.

The mix of bug classes fits that reading. Path traversal, SSRF, data exfiltration and command injection are long-familiar vulnerabilities. They are showing up again in a setting where developers may assume the model will only produce reasonable arguments. A model that has been manipulated through prompt injection, or that is simply wrong, can hand a tool a malicious argument as easily as a harmless one.

Reading the numbers carefully

A few cautions are warranted.

• Coverage was partial. Only a subset of the 3,405 extracted tools was exercised 2. The 253 figure says nothing about the untested majority, which could plausibly hold more bugs.
• The worst findings are a small share. The most severe classes, command injection, data exfiltration and SSRF, total 15 of the 253 confirmed bugs 2. Most findings fall into categories whose real-world impact depends on how the output is used 2.
• The review appears rigorous. Cutting 508 candidates to 253 removed about half of the raw output. That suggests the team didn't inflate its headline number with automated noise 2.

What it means for enterprise agent deployments

For organizations rolling out autonomous agents, the practical takeaway is that the MCP server layer is now part of the attack surface. Many of these servers are open-source projects pulled in to give agents new capabilities quickly. The findings suggest teams should audit them like any other third-party dependency that touches sensitive resources, not treat them as simple glue code.

The defensive measures are well known:

• Validate and canonicalize file paths against an allowlisted root.
• Restrict outbound requests to approved destinations.
• Sanitize anything written to logs.
• Never pass model-supplied strings into shell commands without strict controls.

What appears to be missing is the habit of applying these measures when the input comes from a model rather than a person.

This analysis also suggests a lesson for testing. ToFu's design, focused on semantic security violations rather than crashes 2, implies that existing fuzzing pipelines may give agent tooling an overly clean bill of health. Teams relying on crash-based coverage alone could be missing whole categories of flaws.

The bottom line

The study does not show that MCP itself is broken. It shows that many people building on MCP are repeating old input-handling mistakes in a new context. With 253 verified bugs spread across 118 servers 1, the problem looks systemic rather than isolated. The fix is less about new technology than about extending ordinary distrust of input to the output of language models.