June 4, 2026
Open-source methodology by OWASP, CoSAI, CSA, and NIST contributors enables enterprises to compare AI agents by security risk for the first time
Read moreJune 4, 2026
Open-source methodology by OWASP, CoSAI, CSA, and NIST contributors enables enterprises to compare AI agents by security risk for the first time
Read moreJune 4, 2026
Open-source methodology by OWASP, CoSAI, CSA, and NIST contributors enables enterprises to compare AI agents by security risk for the first time
Read more
The Model Context Protocol (MCP) is rapidly emerging as the backbone of autonomous agent communication—akin to what TCP/IP is for the internet. But with its rising adoption comes a growing wave of exploits. As researchers and attackers alike publish new vulnerabilities, it’s critical to understand the full scope of MCP Security Issues affecting today’s systems.
This article compiles the 12 most critical MCP security issues, explains what makes each one unique, and provides direct links to every documented real-world example—including blog posts, advisories, proof-of-concept (PoC) code, and research papers.
We analyzed 40 verified sources—including research publications, vendor blogs, and independent hacker write-ups. Using a structured 5W-1H analysis (Who, What, When, Where, Why, and How), we eliminated duplicates and kept only MCP Security Issues with unique root causes and technical depth. Each flaw was validated with concrete evidence, such as PoC code or detailed exploit descriptions.
Below is the final, de-duplicated catalogue of the top security vulnerabilities in the Model Context Protocol (MCP). Each entry was rigorously reviewed from first principles, validated against fresh sources, and filtered through a 5W-1H matrix to ensure it represents a unique, root-cause flaw.
| 5W-1H lens | Question we ask for every candidate weakness | Result we keep only if unique |
| Why | What attacker objective does this enable? | If two issues serve the same objective and arise from the same root cause, we collapse them. |
| What | What root-cause flaw makes it possible? | This is the category key in the final list – must be one per row. |
| Who | Which actor must be malicious or compromised? | Confirms we’re not just renaming insider vs outsider variants of the same bug. |
| When | At which protocol phase does the exploit occur? | Installation, tools/list , invocation, runtime… Overlap here does not merge rows if the root cause differs. |
| Where | Which MCP component or surface is hit? | Verifies we’re not describing the same flaw on different hosts. |
| How | Concrete mechanism or payload? | Used only for examples, never for row names. |
All overlapping issues that failed the uniqueness criteria—such as “line-jumping,” “tool-poisoning,” and “resource-poisoning”—were consolidated under their root-cause category, for example: Untrusted Context Injection.
Observed in 10 unique occurrences across the ecosystem. Malicious content injected into any part of the context—such as tool descriptions, tool lists, memory, or external files—can trick the LLM into executing unauthorized actions. In-depth analysis: The Trail of Bits Blog — “Jumping the Line”.
Observed in 4 unique occurrences across the ecosystem. An MCP server that was previously approved can later swap in malicious code or alter schemas without detection, enabling hidden attacks. Detailed example: Phala Network — “Rug Pull” section.
Observed in 4 unique occurrences across the ecosystem. Due to the MCP specification using only the <code>name</code> field for identification, attackers can hijack calls by registering duplicate or lookalike tool names. Deep dive: HiddenLayer — Tool Name Typosquatting.
Observed in 3 unique occurrences across the ecosystem. Many MCP servers expose unauthenticated HTTP endpoints or skip essential protections like TLS encryption and payload signing. This allows attackers to spoof responses or launch man-in-the-middle (MITM) attacks. Detailed reference: Upwind — Unpacking the Security Risks.
Observed in 3 unique occurrences across the ecosystem. MCP servers frequently request overly broad OAuth scopes (e.g., ../.), which grant them access far beyond what’s needed. If such a server is compromised, attackers can inherit full-tenant data access and control. Detailed reference: Pillar Security — Excessive Permission Scope.
Observed in 3 unique occurrences across the ecosystem. Tokens stored in plain text or exposed through logging can be stolen and reused by attackers to launch rogue MCP servers that impersonate legitimate ones. Detailed reference: Pillar Security — Token Theft.
Observed in 2 unique occurrences across the ecosystem. Servers relying on stdio, shell passthrough, or vulnerable to path traversal can expose the MCP host to arbitrary code execution, enabling full system compromise. Detailed reference: Upwind — RCE Call-Out.
Observed in 2 unique occurrences across the ecosystem. Unverified container images and third-party packages can introduce backdoored MCP binaries during the build or deployment process. Detailed reference: Upwind — Supply-Chain Risk.
Observed in 2 unique occurrences across the ecosystem. Without immutable logging in place, it’s impossible to verify or refute what actions an MCP server performed after an incident occurs. Detailed reference: Upwind — Visibility & Observability.
Observed in 2 unique occurrences across the ecosystem. Excessive or recursive tool calls, along with oversized context payloads, can exceed token limits and consume CPU, resulting in denial-of-service. Detailed reference: arXiv 2504.08623 — DoS Case Study (Phala Network).
Observed in 2 unique occurrences across the ecosystem. Crafted prompts can hijack multi-agent workflows by redirecting tool calls through compromised or rogue agents, taking control of the agent swarm. Detailed reference: ForAISec — Protocol Hijack Analysis (Medium).
Observed in 1 unique occurrence across the ecosystem.
Differences in MCP parser implementations can lead to inconsistent behavior — a payload rejected by one implementation might be accepted and executed by another. Detailed reference: arXiv 2504.03767 — Parser Quirks (Trail of Bits Blog).
Each of the 12 documented vulnerabilities targets a distinct root cause. Here’s why they do not overlap.
This table helps defenders understand where and when different issues apply — and who the primary threat actor is in each case.
| Phase (“When”) | Surface (“Where”) | Relevant rows | Primary “Who” threat actor |
| Build time | Container images & dependencies | 8 | Malicious package maintainer |
| Deployment | MCP server config & auth | 4, 6 | Cloud attacker or insider |
| First Run | Tool fetch ( tools/list ) | 1, 2, 3 | Rogue MCP server |
| Runtime | Agent loops & cross-agent calls | 1, 7, 10, 11, 12 | External attacker or compromised agent |
These issues are not theoretical — they are already being exploited in the wild. Security teams must proactively test, validate, and harden their agentic AI systems before deployment. If you’re working with LLMs, toolchains, or autonomous workflows, now is the time to operationalize secure-by-design principles.
Adversa AI helps organizations red-team their AI systems, uncover hidden vulnerabilities, and build defenses that last. Get in touch to learn how we can help secure your agent stack — before attackers do.
Stay up to date with what is happening! Get a first look at news, noteworthy research and worst attacks on AI delivered right in your inbox.
This appendix includes 40 verified URLs that document real-world MCP Security Issues, research papers, exploit demos, and security analyses across trusted sources. Use it to explore deeper technical insights behind each issue described in the catalogue.
MCP Security Issues and How to Fix Them
June 3, 2025
2025MCP SecurityArticle[ Stay updated ]
Adversa AI research, red teaming findings, and threat intelligence, straight to your inbox. No noise.
Form not loading? Open it in a new tab.
July 6, 2026
July's security digest covers the critical MCP vulnerabilities, real-world MCP exploitation, NSA's official MCP hardening guidelines. Explore these…
June 4, 2026
May 2026 top MCP security resources include a breakdown of fundamental transport flaw exposing 200,000 servers, a reference MCP architecture, and tools to…
May 6, 2026
May 2026 top MCP security resources include a breakdown of fundamental transport flaw exposing 200,000 servers, a reference MCP architecture, and tools to…
