The integration layer nobody assigned an owner

Somewhere in your organization, an AI agent has a credential to your source control, a read path into a production database, and a Slack token that can post as a real employee. Nobody in security signed off on that combination. It arrived one integration at a time, each one individually reasonable, until the total set of permissions became something no one would have approved in a single review.

The Model Context Protocol is how most of that access gets wired up. Anthropic published it in late 2024 as a standard way for a language model to reach files, databases, APIs, and SaaS tools, and the ecosystem took it up faster than almost any integration standard in recent memory. The package count passed 150 million downloads by mid-2025. Claude Desktop, Cursor, Windsurf, and a long list of coding assistants shipped native support. For a development team, MCP solved a real problem: instead of writing bespoke glue for every tool, you describe the tool once and any compliant agent can use it.

In April 2026, OX Security published research showing a command execution flaw sitting in Anthropic's official MCP SDKs for Python, TypeScript, Java, and Rust. The estimate attached to it was 200,000 vulnerable instances. Anthropic's response was to confirm the behavior is intentional and update a SECURITY.md file noting that STDIO adapters should be used with care. The SDK was not changed. Sanitization responsibility moved to every downstream developer who trusted the reference implementation.

If your team runs agents against internal systems, this is a problem you inherited without being told.

What the STDIO transport actually does

MCP defines two transports. Streamable HTTP handles remote servers. STDIO handles local tool integrations, and it is the default in Anthropic's documentation and reference SDKs, which made it the most widely deployed path in the ecosystem.

The flaw is in how STDIO builds the process it launches. Configuration values get passed to the host operating system's shell without sanitization or validation. Any command string handed to that interface executes on the machine, whether or not it ever initializes a valid server. An attacker who can influence an MCP configuration file gets arbitrary code execution on the host. That influence is cheaper than it sounds. A compromised repository, a package registry entry, or a convincing message to one developer is enough, and a config block takes seconds to paste.

OX documented four exploitation families against live production systems: unauthenticated injection where configuration is fetched from an external source, authenticated injection where a valid user configures a server from an attacker-controlled package, hardening bypasses that defeat shell restrictions and process sandboxing, and a chained variant that adds privilege escalation for persistence or lateral movement.

More than ten downstream projects were affected. LiteLLM, LangChain, LangFlow, Flowise, LettaAI, LangBot, LibreChat, DocsGPT, Bisheng, and Windsurf all carried exposure. Seven high or critical CVEs are confirmed. Most shipped patches. As of the research publication, Windsurf had not.

The deeper problem is what happens to a reference implementation. It becomes the baseline for an ecosystem, and most developers building on it have no reason to suspect the safe-looking default is the dangerous one.

Four attack classes that need no CVE at all

Patching is necessary and insufficient. The protocol specification itself provides no defense against the following, which means there is no version number you can upgrade to that makes them go away.

Tool poisoning

Agents read tool descriptions. Users usually do not. That gap is the attack surface.

A tool description is the text telling the model what a tool does and how to call it. It gets consumed by the model at runtime and is rarely surfaced in any interface a human reviews. Invariant Labs demonstrated in April 2025 that a malicious trivia-game server could embed instructions in its description aimed at a legitimate WhatsApp server connected to the same session. The agent followed them, pulled message history, and sent it outbound through the trusted server. The traffic looked normal because it was normal. Transport encryption offered nothing, since the exfiltration happened above the encryption boundary using the agent's own legitimate access.

Rug pulls

MCP has no mechanism for tracking changes to tool definitions or requiring re-approval when they change. A server can present benign tools to earn approval, then alter its definitions in later sessions. From the agent's side nothing looks different, because a tool definition is just text, and text can be edited by whoever publishes the server. The agent keeps transacting with it, and nothing detects that the tool approved on day one is not the tool being invoked today.

CVE-2025-54136 in Cursor is the documented version of this. An attacker committed a harmless MCP configuration to a shared repository, waited for a developer to approve it, then replaced it with a payload in a later commit. Every subsequent Cursor session ran the attacker's commands with no new prompt. Check Point Research noted that any credential reachable by the Cursor process was in range. Cursor 1.3 now forces re-approval on any configuration change, down to whitespace.

Cross-server tool shadowing

One MCP session can connect an agent to dozens of servers at once: filesystem, GitHub, Slack, Stripe, a database connector. A malicious server can inject descriptions that redefine how the agent understands its neighbors, routing requests through trusted servers in ways nobody authorized. The legitimate integrations never change. They just start carrying traffic they should not.

The authentication gap

The MCP authorization spec defines an OAuth 2.1 framework and then marks authorization optional. A July 2025 internet-wide scan found 1,862 MCP servers publicly reachable and answering unauthenticated tool-listing requests. Anyone with network access could enumerate capabilities and probe for exploitable behavior without a credential.

Zero trust guidance has said never trust, always verify for years. An unauthenticated management interface on an agent's tool layer is a direct contradiction of it, regardless of what a specification permits.

Two incidents worth studying

The postmark-mcp package is the cleanest example of supply chain patience. It shipped fifteen working versions to npm to build a trust baseline, then version 1.0.16 added one line that blind-copied every outgoing email to an attacker address. Roughly 300 organizations had it in live workflows when it was pulled.

The Supabase-Cursor incident shows what over-privilege does to an otherwise ordinary automation. A Cursor agent with service-role database access was processing support tickets containing user-supplied text. Attackers put SQL directives in the ticket content, the agent read integration tokens, and it posted them into a public support thread. Nobody wrote a malicious integration. A support workflow with too much authority and no boundary between user input and executable instruction produced a breach.

In both, the way in was the supply chain, and the damage scaled with whatever the agent could already reach without asking anyone.

What to do this quarter

Start with inventory, because you cannot secure what you have not listed. Include the servers that arrived through developer tooling, which is where most of them are. Cursor, Windsurf, and Claude Desktop configurations on developer laptops count. For each server, check patch status against the published CVE list and update what has a fix.

Then isolate the process. MCP server processes belong in dedicated containers or sandboxes with no reach into host credentials, API keys, or sensitive paths. Block or log shell execution from inside the MCP process context at the container boundary. This does not fix the design flaw. It decides how far an attacker gets once the flaw is used, which in practice is what separates a logged event from a reportable breach.

• Audit every place externally sourced data reaches STDIO configuration parameters, and put strict allowlist validation in front of any process execution. Nothing from a user, a registry, or a network-fetched config file is safe input to that transport. Anthropic assigned that work downstream, so it is yours now.
• Pin versions explicitly and alert when tool definitions change. That is rug-pull resistance the spec does not give you, and it is a few lines in your configuration management.
• Run each MCP server in its own process context with credentials scoped to only what that integration needs. Where servers share a session, mediate cross-server interaction through an explicit policy layer instead of trusting the model's reasoning to hold the boundary. That reasoning is exactly what tool description injection targets.
• Extend runtime monitoring to MCP processes. Legitimate servers have predictable profiles. Unexpected child processes, outbound connections to unseen destinations, and file access outside expected paths are all signals worth alerting on.

Treat it as a program, not a patch cycle

The uncomfortable part of the MCP situation is that it follows a well-worn pattern. A protocol wins adoption by optimizing for developer experience, security gets deferred to implementers, and the reference implementation becomes the de facto standard for people who never had the context to evaluate it.

New MCP servers publish without mandatory security review, without authentication requirements, and without a coordinated disclosure path. That ecosystem is still growing, and it is moving into production financial systems, regulated data, and privileged infrastructure. Banking has been flagged specifically, given how much transaction authority agentic systems are being given there.

The governance question is the one that needs an answer this quarter: which categories of MCP tools are permitted in your environment, what authentication and sandboxing they require, what monitoring is attached, and who owns that decision. A CVE remediation sprint closes tickets and leaves the harder question alone. Most organizations still cannot say which MCP servers are running on their developers' laptops today, and that inventory is the precondition for every other control in this article.