MCP Security Explained: What the Model Context Protocol Means for Enterprise Risk.

In November 2024, Anthropic published a technical specification called the Model Context Protocol. Most enterprise security teams didn't notice. By March 2026, MCP had 97 million monthly SDK downloads, was supported by every major AI provider — OpenAI, Google, Microsoft, AWS — and had become the default architecture for connecting AI agents to enterprise systems. The Vulnerable MCP Project, run by researchers from SentinelOne, Snyk, Trail of Bits, and CyberArk, now tracks 50 known vulnerabilities across the ecosystem. Thirteen of them are classified critical.

If your organization is deploying AI agents — and statistically, it is — you are almost certainly running MCP. This article explains what it is, what attack surface it creates, what real-world incidents have already happened, and what controls actually close the gaps.

What MCP Actually Is

Before MCP, connecting an AI agent to enterprise tools was a bespoke engineering problem. Every integration required custom API code. Connecting an agent to Salesforce, Slack, GitHub, and a PostgreSQL database meant building and maintaining four separate integrations — and rebuilding them every time a provider changed their API. The technical term for this is the N×M problem: N agents multiplied by M tools equals an unmanageable number of custom connections.

MCP solves this by standardizing the interface. An MCP server exposes any tool, database, or service through a uniform protocol. Any MCP-compatible AI agent can connect to any MCP server without custom integration code. The math shifts from multiplicative to additive.

MCP defines three types of primitives: Tools (executable functions — read a file, send an email, run a query), Resources (data the agent can read), and Prompts (templated instructions the server can inject into the agent's context). Each primitive creates a different attack surface.

The Adoption Curve — and Why Speed Is the Problem

Eighteen months from initial release to 97 million monthly downloads. Security frameworks, by contrast, move on a timescale measured in years. That gap between how fast MCP was adopted and how slowly security controls developed is precisely where the current incident wave is coming from.

Real Incidents. Not Hypotheticals.

These are confirmed or researcher-demonstrated attacks on production-realistic configurations. They happened because security architectures were not designed for agentic AI.

The 6 MCP Attack Vectors Your Team Must Understand

1. 1

   Indirect Prompt Injection via MCP Tool Responses

   An attacker embeds malicious instructions inside content the agent processes — a support ticket, a GitHub Issue, a document. When the agent retrieves this via MCP, it executes the embedded instructions against real systems. The critical difference from chatbot jailbreaking: agents take actions, not just produce text.

   Real incidents: GitHub MCP · Supabase Cursor (2025)
2. 2

   Tool Poisoning — Malicious MCP Servers

   A malicious or compromised MCP server presents as legitimate but returns manipulated responses designed to alter agent behavior or exfiltrate data. Real-world benchmarks report tool poisoning success rates exceeding 60% against major LLM agents — 72% against some models.

   Source: MCPTox / arXiv benchmarks, 2026
3. 3

   Excessive Privilege — Overpowered Agent Permissions

   The Supabase research scenario was possible because the agent had full service-role database access — bypassing all Row-Level Security — for a task requiring only read access to support ticket text. AI-related access configurations with excess permissions jumped from 12% to 39% of deployments between 2024 and 2026.

   Source: Microsoft 2026 Data Security Index
4. 4

   Credential Exposure in MCP Config Files

   API keys and service tokens stored as plaintext in MCP server config files. Tool poisoning attacks can force clients to read and return these files. Local servers executing OS commands can further escalate by reading SSH keys and cloud provider credentials from the host environment.

   Datadog audit: 12,000+ credentials exposed (2026)
5. 5

   Agent Memory Poisoning

   Malicious content injected into an agent's context across multiple interactions gradually shifts its behavior — with no single interaction looking suspicious. Corrupts long-term memory or RAG knowledge bases incrementally, persisting across sessions and evading single-event monitoring.

   Source: TrueFoundry MCP Security Research, 2026
6. 6

   Zero Authentication on Development MCP Instances

   CVE-2025-49596 (CVSS 9.4) exploits a missing authentication layer between the MCP Inspector client and its proxy. The attack is browser-based: a malicious website uses DNS rebinding to connect to the Inspector running on localhost and execute arbitrary OS commands. No direct network exposure required — a developer simply visiting a malicious site while running Inspector is enough. Patched in v0.14.1; the broader OX Security research identified ~200,000 vulnerable instances across the MCP ecosystem.

   CVE-2025-49596 · CVSS 9.4 · OX Security, 2026

Why Traditional Security Tools Don't See These Attacks

Standard enterprise security — SIEM, WAF, DLP, endpoint detection — was designed for a world where humans initiate actions and systems execute them. MCP creates a different model: an AI agent autonomously initiates tool calls, processes responses, and takes subsequent actions with no human in the loop for individual decisions.

Controls That Actually Work

Summary: Three Actions This Week

MCP is not going away. Neither is the attack surface it creates. Three actions that materially reduce your MCP risk exposure immediately:

1. Inventory every MCP server your agents connect to. You cannot secure what you cannot see. Complete list, who deployed each server, what permissions it runs with, and whether any instance is running without authentication.

2. Audit agent permission scopes against least privilege. If any agent has write access or service-role credentials for a task that only requires reading data — that misconfiguration needs immediate correction.

3. Establish an inspection point between agents and MCP servers. This is the control that would have prevented every attack in this article. It has to exist.