As the Model Context Protocol ecosystem grows, the attack surface is shifting from theoretical risks to concrete exploitation. This month’s digest highlights critical architectural weaknesses, ranging from “overthinking loops” that drain API budgets to high-privilege RCE vulnerabilities in Claude Desktop extensions.
Total resources: 8
Category breakdown:
| Category | Count |
|---|---|
| Threat Model | 3 |
| Defense | 2 |
| Vulnerability | 1 |
| Research | 1 |
| CISO | 1 |
Analysis reveals that MCP has become AI’s fastest-growing attack surface, with 30 CVEs filed in just 60 days. The data shows that 38% of 500+ scanned servers completely lack authentication.
This post demonstrates three distinct MCP attack techniques, providing working code examples and PoC implementations. It specifically details external prompt injection, tool prompt injection, and cross-tool hijacking.
This article provides a systematic catalog of 11 MCP vulnerability classes, highlighting supply chain typosquatting and cross-server context abuse. It includes details on CVE-2025-6514 (CVSS 10.0 RCE) and tool poisoning risks.
This guide presents a Microsoft ISE production-ready MCP server implementation. It features detailed code examples for OAuth 2.1, JWKS-cached token validation, and OBO flows.
This post outlines a comprehensive tool-level access control architecture for MCP. It covers per-tool permissions, server-level policies, and agent-scoped access boundaries suitable for enterprise deployments.
A critical architectural decision in Claude Desktop Extensions allows MCP servers to run with high privileges. This configuration enables chaining low-risk tools to high-risk local executors, potentially leading to zero-click RCE via malicious calendar invites.
Researchers have identified that malicious MCP tool servers can exploit tool-using LLM agents by inducing cyclic ‘overthinking loops’. This attack surface amplifies token consumption up to 142.4x and increases latency, creating a severe denial-of-wallet risk.
This article provides a comprehensive risk catalog of MCP attack surfaces including supply chain threats and tool poisoning. It specifically addresses chaining abuse and transitive trust violations with compliance mapping.
The discovery of critical RCEs in both reference and downstream MCP implementations proves that isolation is no longer optional for agentic systems. Security teams must enforce privilege restrictions, timeouts, and cost controls for all MCP servers in production to prevent significant financial and technical compromise. Once those measures are in place, consider red teaming your AI stack to verify that these controls hold.
Our March 2026 digest analyzes notable Agentic AI security developments, including critical OpenClaw and GitHub Copilot vulnerabilities, offering 27 essential resources, frameworks, and tools to help CISOs and security engineers ...
