The exposure is larger than it looks
The Model Context Protocol lets agents connect to external tools — file systems, APIs, databases, other services — through a standardized interface. That's the value. The risk is that MCP servers aren't just data sources. They return content the agent reads and acts on. A compromised or malicious MCP server can inject instructions directly into the agent's working context.
492
MCP servers publicly exposed with no authentication — Trend Micro, 2026
9.8
CVSS score — CVE-2026-33032, unauthenticated command execution via MCP endpoint
CVE-2026-33032 — CVSS 9.8
An MCP integration failed to authenticate requests to its message endpoint, allowing unauthenticated remote code execution. The agent processed the response and acted on it. Disclosed May 2026.
The three attack patterns to know
MCP attacks don't look like traditional exploits. They target the trust relationship between an agent and the tools it calls.
01Tool poisoningHidden instructions embedded in tool descriptions or responses. The agent reads the output, interprets the embedded instruction as legitimate, and executes it — with full credentials.
02Server impersonationA lookalike MCP server that mimics a trusted tool. The agent connects, receives malicious instructions, and acts on them. Authentication is optional in the MCP spec for non-stdio implementations — most teams don't enforce it.
03Rug pullA community-hosted MCP server that pushes a malicious update after being established as trusted. No new connection required — the agent already trusts it.
What securing MCP actually requires
Treating MCP server outputs as untrusted content is the baseline. That means every tool response goes through the same scrutiny as any other external input — not implicit trust because the connection was established. Beyond that:
→Enforce authentication on every non-stdio MCP connectionThe spec makes it optional. Treat it as mandatory. Any server that can't authenticate doesn't connect.
→Scope permissions per MCP serverAn agent connecting to a calendar MCP server should not have file system write permissions. Map what each server needs and enforce least-privilege at the connection layer.
→Intercept tool calls before executionRuntime enforcement at the tool invocation layer means that even if a poisoned MCP server causes the agent to attempt a policy-violating action, the call is blocked before it completes. The agent can't be used as a relay for unauthorized operations.
MCP is infrastructure. Treat it like infrastructure — with the same access controls, authentication requirements, and enforcement you'd apply to any other system your agents touch.