Connecting your AI to an MCP server lets a stranger into the room.
The Model Context Protocol lets an AI assistant use outside tools. But every server you connect gets to write text your model reads as instructions, can run code on your machine, and can call your other tools. None of this needs a bug. It is how the protocol works.
00 — What you're plugging into · 60s
36.5%Average success rate of hidden-instruction attacks across 20 AI agents (MCPTox benchmark)
Sept 2025First malicious MCP server found in the wild: a lookalike package that copied every email
10 CVEsFrom a single April 2026 study of how local MCP servers launch code
Part · Hidden instructions
01Rug pull · 90s
The tool you approved turns bad later
ON THE RECORD3 documented cases
Aug 10–12, 2026Real-world harm
Deadbugz campaign
A server behaved for three tool calls, then rewrote its own metadata to collect SSH keys, AWS credentials, shell history and kubeconfig, and told the model to hide it. It arrived as 23 pull requests in 74 minutes.
Aug 2025CVE
Cursor “MCPoison” · CVE-2025-54136
Cursor tied approval to the server’s name. A repo could swap the command after you approved it and run code on every launch. Fixed in Cursor 1.3.
Apr 2025Proof of concept
WhatsApp “sleeper” server
A harmless “fact of the day” server changed its tool description on a later load and exfiltrated WhatsApp message history.
HOW IT WORKS
You review a server once and approve it. Later, the server quietly rewrites its tool descriptions. Your approval still stands, and the model now follows the new instructions.
DEFEND
→Pin the full tool definition, not just the name
→Re-approve on any change
→Pin exact package versions
02Tool poisoning · 75s
Hidden instructions in the tool description
ON THE RECORD2 documented cases
Apr 1, 2025Proof of concept
Invariant Labs’ poisoned “add” tool
A simple add tool told Cursor to read ~/.ssh keys and mcp.json and pass them in a hidden argument, padded with spaces so it scrolled off-screen.
2025Research
MCPTox benchmark
36.5% average attack success across 20 agents, peaking at 72.8%. More capable models were often more susceptible, and the best refusal rate was under 3%.
HOW IT WORKS
The model reads a tool's whole description. You usually see only its name. Instructions hidden there can make the model read files and slip them into a call.
DEFEND
→Read every tool description in full before connecting
→Scan with an MCP scanner
→Use clients that show full call inputs
03Shadowing · 75s
A bad server hijacks your trusted tools
ON THE RECORD2 documented cases
Apr 2025Proof of concept
A rogue server rewires your email tool
A malicious server’s description added a “rule” that redirected a trusted send_email tool’s mail to the attacker. The malicious server was never called.
Apr 2025Proof of concept
WhatsApp history exfiltrated
The same technique combined with a rug pull to forward a user’s WhatsApp history through a trusted messaging server.
HOW IT WORKS
One server's description can set “rules” for another server's tools, like “always BCC this address when sending email.” The bad server never even has to be called.
DEFEND
→Keep unknown servers in a separate session
→Never mix them with email, files or messaging servers
Part · Data exfiltration
04Lethal trifecta · 90s
Private data + untrusted text + a way out
ON THE RECORD2 documented cases
May 26, 2025Proof of concept
GitHub MCP private-repo leak
A malicious public issue made the agent copy private-repo data, including salary information, into a public pull request.
July 2025Proof of concept
Supabase MCP table dump
A support ticket made Cursor dump database tables using the service_role key, which bypasses row-level security. Supabase reports no customer leak and moved to read-only defaults.
HOW IT WORKS
An agent that can read private data, reads content an attacker wrote, and can send data out can be turned against you. An unknown server supplies two of the three by itself.
DEFEND
→Least-privilege, read-only tokens
→Human approval for any write
→Break one leg of the trifecta per session
Part · Supply chain & sign-in
05Fake package · 60s
The lookalike you installed by mistake
ON THE RECORD3 documented cases
Sept 25, 2025Real-world harm
postmark-mcp: the first malicious MCP server
Version 1.0.16 added one line that BCC’d every email to an attacker’s domain. 1,643 downloads. The official package is @activecampaign/postmark-mcp.
Feb 2026Real-world harm
Trojanized Oura server
SmartLoader cloned an Oura MCP repo, faked contributors and forks, got it listed, and used it to deliver the StealC info-stealer.
June 2026Real-world harm
mcp-server-* npm squats
Amazon Inspector flagged lookalikes of mcp-server-git, -fetch, -notion, -postgres and -redis, aimed at agents running npx.
HOW IT WORKS
Attackers publish packages with names close to official ones, ship clean versions to build trust, then add a backdoor in an update.
DEFEND
→Install only the vendor's scoped official package
→Pin exact versions, never @latest
06Connect = code execution · 60s
Just signing in runs the attacker's code
ON THE RECORD3 documented cases
July 9, 2025CVE
mcp-remote · CVE-2025-6514 · CVSS 9.6
A crafted sign-in address from the server was handed to the OS shell. Versions 0.0.5–0.1.15, 437k+ downloads. Fixed in 0.1.16.
June 13, 2025CVE
MCP Inspector · CVE-2025-49596 · CVSS 9.4
The local dev proxy could be reached from a web page and made to run commands. Fixed in 0.14.1; a later report says the fix was incomplete.
Oct 2026Real-world harm
OpenCode sign-in RCE
A malicious server could run code on Windows and WSL during “opencode mcp auth”. No CVE was issued.
HOW IT WORKS
A malicious server can hand your client a crafted sign-in address. Unpatched tools passed it to the operating system, which ran it as a command.
DEFEND
→Patch your client and helpers first
→Never sign in to an unknown server from your main machine
Part · Session & hosting
07Phishing in chat · 60s
The server asks you, or your model, directly
ON THE RECORD3 documented cases
2025Proof of concept
Fake remote server phishing
A fake server announced “MCP support” for a payments brand and used in-chat prompts to phish credentials.
Late 2025Research
Unit 42: sampling abuse
Hidden instructions in sampling requests drained the user’s tokens, hijacked conversations and wrote files covertly.
2026Research
URL elicitation moves phishing to the browser
The spec bans asking for secrets in forms, but a server can still send you to a login page of its choosing.
HOW IT WORKS
Servers can pop up forms or login links in your chat (elicitation), and can ask your own model to write things for them (sampling), using your context and your tokens.
DEFEND
→Never type secrets into a server's form
→Turn off sampling for untrusted servers
08Remote server risk · 60s
Everything you send, they keep
ON THE RECORD2 documented cases
June 4–18, 2025Real-world harm
Asana cross-tenant exposure
A logic flaw let data cross between customers, roughly 1,000 of them. The server was offline June 5–17. No attacker was involved.
Oct 2025Research
Smithery hosting breach
A path traversal in hosted builds leaked a Fly.io token controlling 3,000+ apps, mostly hosted MCP servers, exposing client traffic with API keys.
HOW IT WORKS
A remote server sees every argument you send. It can log it, retain it, or be breached. A trusted vendor's server is only as safe as its hosting.
DEFEND
→Read the privacy and retention terms
→Send the minimum data
Part · Defense
09Vetting a server · 90s
How to vet a server before you connect
ON THE RECORDOfficial guidance
July 28, 2026Guidance
MCP security best practices
The spec now requires one-click installers to show the exact command and says clients should sandbox servers.
2025Guidance
OWASP MCP Top 10
Ten categories from token mismanagement to shadow MCP servers, a shared vocabulary for reviews.
2026Guidance
Vendor guidance
Claude Code: verify you trust each server before connecting. VS Code: only trust configurations you have reviewed.
HOW IT WORKS
Who runs it, what it can reach, what it logs. If you can't answer all three, don't connect. If you must test it, do it in a sandbox with throwaway credentials.
COVERS
→Publisher checks and source review
→Sandboxing and network limits
→Pinning, auto-approve off, monitoring
Timeline
Nov 2024Anthropic releases MCP
Apr 2025Invariant Labs discloses tool poisoning, rug pulls and shadowing
May 2025GitHub MCP prompt-injection leak of private repo data (demo)
Jun 2025Asana MCP cross-tenant exposure · MCP Inspector RCE (CVE-2025-49596) · “lethal trifecta” named
Jul 2025Supabase MCP leak demo · mcp-remote RCE (CVE-2025-6514)
Aug 2025Cursor MCPoison (CVE-2025-54136)
Sep 2025postmark-mcp: first malicious MCP server found in the wild
Feb 2026Trojanized Oura MCP server delivers an info-stealer
Apr 2026OX Security stdio research: 30+ disclosures, 10 CVEs
Jun 2026Malicious mcp-server-* npm squats flagged
Jul 2026MCP spec 2026-07-28 tightens authorization
Aug 2026Deadbugz runtime rug-pull campaign
Sep–Oct 2026MCP Python SDK OAuth advisory · OpenCode sign-in RCE
Before you connect
CHECKLIST
- Confirm the vendor links to this exact package or URL
- Read every tool description and parameter in full
- Check whether it asks for sampling, elicitation or broad file access
- Use a dedicated, read-only, short-lived token
- Run local servers in a container with no home folder access
- Limit network access to the one API it needs
- Keep it in a session with no email, files or databases
- Turn auto-approve off
- Pin versions and full tool definitions; re-approve on change
- Log every tool call
DON'T CONNECT IF…
- No verifiable link between the vendor and the package
- The name is a lookalike of an official package
- Descriptions talk to the model, mention other tools, or say “don't tell the user”
- The install command pipes a script from the internet
- It wants an admin or full-access token
- It tells you to turn on auto-approve
- The sign-in page is on an unexpected domain
- It arrived in an unsolicited PR, DM or post
- A remote server has no privacy policy or named operator