A developer at a mid-sized fintech wired a calendar tool into an internal agent on a Thursday afternoon. It worked on the first try. Nobody asked which server that tool actually lived on, who published it, or what else it could reach once the agent handed over a token. That connection is now one of the shortest paths into the company's data, and nobody logged it as a change.
Why It Matters
The standard advice right now is to start with identity. Give every agent a verifiable name and scope what it can touch. That advice is correct, and it is also about a year behind where things are actually breaking. An agent with a flawless identity that calls a compromised tool server is still an agent shipping your data somewhere it should not go. Giving every AI agent a verifiable identity answers who is acting. It says nothing about what sits on the other end of the connection.
Model Context Protocol is the plumbing. It standardises how an agent discovers a tool, calls it, and gets structured results back, which is precisely why it spread so quickly and precisely why it became the weak joint. A July 2025 internet scan cited in the Cloud Security Alliance's May 2026 research note counted 1,862 publicly reachable MCP servers running with no authentication at all. Not sitting misconfigured behind a gateway. Just open.
The NSA put its own reading on paper. Its Cybersecurity Information Sheet on MCP security design, version 1.0, published May 2026, states that the protocol's proliferation has outpaced the development of its security model, then sets out why: unsanitised inputs reaching execution environments, no role-based access control, serialization without schema enforcement, optional authorization with loose token lifecycles, and audit logging that varies wildly between implementations. None of that is exotic. Those are the basics, missing.
Four numbers frame how large this is, and not one of them describes a single vendor's bug.
Deprecation window
12 months
for legacy MCP versions
Exposed instances
200,000
flagged across the supply chain
Breach cost
$4.99M
IBM 2026 global average
SDKs affected
4 of 4
Python, TypeScript, Java, Rust
The SDK ratio is the one that should change how you triage. When the defect sits in the reference implementations for every supported language, patching your own server code buys you nothing, because the weakness arrived with the library rather than with your developer. That converts an application fix into a dependency inventory problem, and most teams do not have that inventory in any usable form.
Every official SDK carried the same design flaw. That is not a bad implementation. That is a bad assumption, shipped in four languages at once.
What the Record Actually Shows
Strip out the vendor commentary and a short, unflattering timeline is left. Documented incidents, a government advisory, a spec rewrite, and a disclosure process that moved at the speed of an open source side project rather than of critical infrastructure.
| Category | Detail | Insight |
|---|---|---|
| Advisory | NSA Cybersecurity Information Sheet, Ver. 1.0, May 2026 | Names code execution and missing RBAC |
| Spec | Release 2026-07-28, stateless via six SEPs | Session hijacking removed at protocol layer |
| CVEs | 7 high or critical CVEs confirmed as of May 2026 | Systemic design, not isolated coding bugs |
| Supply chain | postmark-mcp backdoor reached 300 organisations, September 2025 | One package silently copied outgoing mail |
| Disclosure | 30+ disclosures filed April 2026; policy file updated 9 days later | Response lag measured in days |
| Blast radius | 150 million MCP package downloads by mid-2025 | Reach scales faster than review capacity |
| New risk | MCP-Method and MCP-Name headers can carry keys or PII | Header mapping leaks secrets to intermediaries |
| First move | Any server answering without auth: treat as compromised today | Assume access, then prove otherwise |
The through line is that every one of those rows was public before most security teams had MCP on a risk register. The information was never the bottleneck. Ownership was, because connector sprawl grows inside engineering while the risk lands on security, and the two functions were looking at different dashboards.
Four publicly documented MCP failures between April 2025 and November 2025, escalating from one product's cross-organisation data leak to remote code execution chained across connected servers.
Friction Points
The 2026-07-28 rewrite is a genuine improvement, and it also demonstrates something uncomfortable about protocol security. Going stateless closed session hijacking and stopped servers from pushing unsolicited prompts at clients. In exchange, Akamai's threat research team, through senior director Maxim Zavodchik, flagged a fresh set: predictable tracking identifiers that allow cross-tenant workflow hijacking, header misuse enabling desync, stored cross-site scripting through MCP Apps as first-class extensions, and hit-and-run denial of service where a client kicks off an expensive long-running task then vanishes. The spec authors did the right thing here, or most of the right thing, anyway.
Budget is the quieter problem. Security teams already carry one long-horizon cryptographic project in post-quantum migration deadlines, and connector inventory work competes for exactly the same small pool of people who understand both the crypto and the pipelines. Something gets deferred. It is usually the one without a regulator attached to it, which right now is this one.
Here is the piece nobody has solved, and I do not believe the specification can solve it alone: signing a tool description only helps if some body governs the registry vouching for the signer. No such governance exists today. My honest read is that the trust anchor question gets settled by a bad incident rather than by a working group, and that the organisations who inventory early will simply be the ones not writing an incident report that quarter.
- Any MCP server that answers without authentication belongs in incident response today, not in next quarter's backlog.
- Tokens minted under the old lifecycle assumptions should be rotated rather than grandfathered into the stateless model.
- Header mapping is the shortcut that looks harmless in code review, which is how secrets end up in MCP-Method and MCP-Name.
- Tool descriptions are attacker-controlled text. Filter each tool's output before it reaches the next tool.
Key Takeaways: the controls the NSA advisory actually names
- Validate every parameter against defined schemas and the expected value ranges.
- Isolate each tool's execution using AppContainers, seccomp, AppArmor or SELinux.
- Extend MCP with cryptographic signatures inside the JSON payload, time bound.
- Log every invocation with exact parameters, the identities involved, and cryptographic hashes of results.
- Scan the network for unauthenticated MCP servers instead of trusting the asset list.
Go find out how many MCP servers your organisation is actually running, counting the one a developer stood up for a demo in March and never took down. Then check which of them accept a connection without asking who is calling. That inventory is a morning's work for one engineer, and every other recommendation in this article is unactionable until it exists.
No comments
Post a Comment