Hey there, folks! Let’s talk about Model Context Protocol (MCP) and its ongoing security woes. It’s a problem that just won’t go away.
Remember when VentureBeat first shed light on MCP’s vulnerabilities back in October? The numbers were staggering. Pynt’s research revealed that deploying just 10 MCP plug-ins could lead to a 92% chance of exploitation. That’s a significant risk, even with just one plug-in in play.
The root cause remains the same: MCP was released without mandatory authentication. Authorization frameworks were only introduced six months after widespread deployment. Merritt Baer, chief security officer at Enkrypt AI, warned us then: “MCP made the same mistake we’ve seen in previous major protocol launches: insecure defaults. If we don’t prioritize authentication and least privilege from the get-go, we’ll be dealing with breaches for years to come.”
And now, three months later, the cleanup has begun — and it’s proving to be worse than anticipated.
Clawdbot changed the game. This viral personal AI assistant, capable of handling your inbox and coding tasks overnight, operates entirely on MCP. Developers who hastily set up a Clawdbot on a VPS without reviewing the security guidelines unknowingly exposed their company to the full spectrum of MCP vulnerabilities.
Itamar Golan foresaw the storm. He offloaded Prompt Security for an estimated $250 million to SentinelOne last year. Just recently, he issued a stark warning on X: “Disaster looms ahead. Thousands of Clawdbots are now live on VPSs … with open ports to the internet … and zero authentication. Brace yourselves.”
And he’s not wrong. When Knostic scanned the internet, they uncovered 1,862 MCP servers exposed without any authentication. They tested 119 of these servers, and each one responded without requiring any credentials.
If Clawdbot can automate tasks, malicious actors can weaponize them.
Three CVEs are exploiting the same flaw
These vulnerabilities are not isolated incidents. They are direct outcomes of MCP’s design choices. Here’s a quick rundown of the vulnerabilities behind these three CVEs:
-
CVE-2025-49596 (CVSS 9.4): Anthropic’s MCP Inspector left a gap for unauthenticated access between its web UI and proxy server, enabling a complete system takeover via a malicious webpage.
-
CVE-2025-6514 (CVSS 9.6): Command injection in mcp-remote, an OAuth proxy with 437,000 downloads, allowed attackers to seize control of systems by connecting to a malicious MCP server.
-
CVE-2025-52882 (CVSS 8.8): Popular Claude Code extensions exposed unauthenticated WebSocket servers, facilitating arbitrary file access and code execution.
Three critical vulnerabilities in just half a year. Three distinct attack vectors. One underlying issue: MCP’s optional authentication feature was often overlooked by developers.
The threat landscape is expanding
Equixly recently scrutinized popular MCP implementations and discovered multiple vulnerabilities: 43% exhibited command injection flaws, 30% allowed unrestricted URL fetching, and 22% leaked files from unintended directories.
Forrester analyst Jeff Pollard elaborated in a blog post, stating: “From a security standpoint, this seems like an effective way to introduce a powerful entity into your environment without any guardrails.”
And he’s not wrong. An MCP server with shell access can be leveraged for lateral movement, credential theft, and ransomware deployment, triggered by a prompt injection tucked away in a document the AI was processing.
Identified vulnerabilities, postponed solutions
Security researcher Johann Rehberger exposed a file exfiltration vulnerability last October. A prompt injection could deceive AI agents into sending sensitive files to malicious accounts.
Anthropic unveiled Cowork recently, extending MCP-based agents to a wider, less security-savvy audience. The same vulnerability persists, and now it’s ripe for exploitation. PromptArmor demonstrated a malicious document that coerced the agent into uploading confidential financial information.
Anthropic’s advice: Users should be vigilant for “suspicious activities indicating prompt injections.”
a16z partner Olivia Moore dabbled with Clawdbot over a weekend and highlighted the disparity: “You’re granting an AI agent access to your accounts. It can peruse your messages, send texts on your behalf, access your files, and execute code on your device. You must comprehend what you’re authorizing.”
Most users don’t. Neither do most developers. And MCP’s framework didn’t necessitate it.
Five steps for security leaders
-
Evaluate your MCP exposure now. Conventional endpoint detection systems spot node or Python processes initiated by legitimate apps. They don’t flag them as threats. You need tools that can pinpoint MCP servers specifically.
-
Enforce authentication as obligatory. The MCP standard advocates for OAuth 2.1. The SDK lacks built-in authentication. Every MCP server interacting with production systems must have authentication enforced upon deployment, not post-incident.
-
Minimize network exposure. Bind MCP servers to localhost unless remote access is explicitly necessary and authenticated. Knostic’s discovery of 1,862 exposed servers hints at accidental exposures.
-
Anticipate prompt injection attacks and prepare for their success. MCP servers inherit the reach of the tools they encompass. If a server wraps cloud credentials, filesystems, or deployment pipelines, devise access controls assuming the agent will be compromised.
-
Mandate human validation for high-risk operations. Demand explicit confirmation before agents dispatch external emails, erase data, or access sensitive data. Treat the agent like a swift but literal junior employee who executes instructions precisely, even those unintended.
The governance void is glaring
Security vendors swiftly seized the opportunity to capitalize on MCP risks, but most enterprises lagged behind.
Clawdbot adoption skyrocketed in Q4 of 2025. Yet, most 2026 security blueprints lack AI agent controls. The gap between developer enthusiasm and security governance spans months. Attackers now have a wide-open window.
Golan hit the nail on the head. This will get messy. The real question is whether organizations will fortify their MCP exposure before someone else exploits it.
