One year of MCP security: nine in ten public servers have no authentication

The Model Context Protocol (MCP) became the default path between AI agents and their tools within eighteen months of its November 2024 announcement, and one of the most attacked pieces of AI infrastructure.

What the numbers say

A July 2026 study audited 414 internet-facing MCP servers of 640 production instances: 91.8% had no OAuth, 687 tools ran shell execution without access controls, and 68 bugs included SQL injection, SSRF and path traversal (Padilla, arXiv, 2026).

The Cloud Security Alliance counts roughly 200,000 vulnerable instances behind 150 million-plus package downloads. An earlier study found command injection in 43% of popular servers, SSRF in 30% and path traversal in 22% (Equixly, 2025).

Five incidents in one year

April 2025: Trail of Bits hid an injection payload in a tool description, which reaches the model's context before any tool is called and bypasses client approval (tool poisoning).

May 2025: an Invariant Labs demo had a GitHub agent read a stranger's issue, open the developer's private repositories and publish them in a public pull request. The agent held a token the issue's author did not.

May to June 2025: Asana's MCP server showed one customer's data to users in other organisations for a month, affecting about 1,000 customers. No attacker was involved.

July 2025: an attacker filed a support ticket with instructions for the assistant. A developer later opened tickets through the Supabase MCP server, which runs with the key that bypasses row-level security; the assistant queried integration_tokens and wrote OAuth secrets back into the ticket.

July 2025: JFrog disclosed CVE-2025-6514 (CVSS 9.6) in mcp-remote, an npm bridge to remote servers. A crafted authorization_endpoint returned during OAuth discovery became command execution on Windows; affected versions passed 437,000 downloads.

The bug that predates all of this

In 1988 Norm Hardy described a compiler that could write to a billing file and let users name their own debug output file. Someone named the billing file: the compiler had the authority the user lacked, and the instruction was not the user's to give.

What actually holds

The controls that hold are unglamorous: authorisation at the tool boundary keyed to the verified principal; sessions that never combine untrusted content, private access and an outbound channel; descriptions treated as data, not instructions; and human confirmation for side effects.

MCP created no new class of vulnerability: it gave four old OWASP-class bugs a new distribution channel and attached each to a component that cannot tell instructions from data.