Artificial intelligence is growing at a pace that few can keep up with — and that includes security teams.
Every new standard that emerges in the AI ecosystem spreads in months, not years.
That is great for the evolution of technology, but it opens gaps that take way too long to close.
This is exactly where MCP servers enter the picture.
Launched by Anthropic in November 2024, the Model Context Protocol — MCP — became the go-to standard for connecting AI agents to external tools and data sources. In less than 12 months, it was already present in virtually every major code assistant and leading AI platform on the market. And the numbers are impressive: in December 2025, Anthropic announced that more than 10,000 active public MCP servers were already in operation, with support from giants like AWS, Google Cloud, and Azure.
Impressive growth, no doubt. But all that speed came at a cost.
While adoption exploded, security fell behind — and the vulnerability window that opened up is larger than most people realize. The threats lurking around this infrastructure range from sophisticated attacks that manipulate agent behavior to data leaks hidden inside seemingly normal calls. And the numbers back it up: 40% of analyzed MCP servers had exploitable vulnerabilities.
Receive the best innovation content in your email.
All the news, tips, trends, and resources you're looking for, delivered to your inbox.
By subscribing to the newsletter, you agree to receive communications from Método Viral. We are committed to always protecting and respecting your privacy.
In this article, you will understand why MCP servers became hackers’ new favorite target, what the main risks are, and what security companies are building right now to try to close this gap before something serious happens. 🔐
How MCP became the standard AI connector in about a year
To understand the problem, you first need to understand what MCP actually does. It works as a standardized bridge between a language model — like Claude, GPT, or any other — and the outside world: files, databases, APIs, development tools, internal company systems. Before MCP, every integration was custom-built, handcrafted, which made everything slower but also more isolated.
The big advantage of an MCP server is that it lets agents, assistants, and code tools use a single interface to securely connect to multiple tools and data sources, instead of needing a custom connector for each case. Leading platforms like ChatGPT, Gemini, Microsoft Copilot, Cursor, and Visual Studio Code have already adopted the standard. This adoption curve validated MCP as Anthropic’s protocol of choice for connections between agents and tools — something rare in the highly competitive language model space.
The problem is that all this fluidity did not come with robust layers of protection from the start — and when a standard spreads this fast without proper controls, it inevitably becomes bait for anyone looking to exploit flaws. Existing AI defenses simply were not built for situations where agents access tools and sensitive systems dynamically.
The scenario got even more delicate because MCP servers do not operate in controlled environments. They are exposed to AI agents that receive instructions from various sources — and those sources are not always trustworthy. An agent can be instructed, for example, to fetch information from a web page or an external document. If that content has been tampered with by an attacker, the agent can start executing actions that nobody authorized, simply because it interpreted that content as a legitimate instruction. This type of attack has a name: prompt injection. And it is particularly dangerous precisely because it does not require direct access to the system — the attack happens within the normal flow of use.
Beyond prompt injection, MCP servers also face another structural issue: the lack of identity verification between servers. When an AI agent connects to an MCP server, in many cases there is no solid mechanism to confirm that server is who it claims to be. This opens the door to server spoofing attacks, where a fake server impersonates a legitimate one and starts receiving — and intercepting — sensitive information that was meant to go somewhere else. With 40% of analyzed servers showing exploitable vulnerabilities, this is not a theoretical risk. It is an operational reality. 😬
What goes wrong when an MCP server has a flaw
When security researchers started taking a closer look at the MCP ecosystem, what they found was an attack surface much broader than expected. OWASP, the Open Worldwide Application Security Project, has already mapped a series of serious threats affecting MCP servers. The combination of rapid adoption, lack of consolidated security standards, and the autonomous nature of AI agents created a set of attack vectors that are still being mapped out.
Among the most relevant threats identified so far, a few stand out for their sophistication and potential for damage:
- Tool Poisoning: a central concern that takes prompt injection to the next level by embedding malicious instructions in tool descriptions, schemas, or return values, manipulating agent behavior.
- Rug Pull: an attack unique to the emerging AI ecosystem, where the attacker changes a tool’s definition after a human has already approved it, exploiting exactly the trust created by that approval.
- Tool Shadowing and cross-origin escalation: the attacker uses a tool description from a malicious server to manipulate how the agent uses tools belonging to another trusted server.
- Data exfiltration through legitimate channels: sensitive information is quietly inserted into calls that look completely normal, like searches and emails, making detection very difficult without a specific analysis layer.
- Privilege escalation: the server receives more access than the task actually requires, creating much greater exposure than necessary.
What makes this set of threats especially tricky to manage is that many of these attacks do not trigger traditional security alerts. They do not look like intrusions — they look like normal system usage. A conventional firewall will not catch a prompt injection embedded in a PDF that the agent was instructed to read. An antivirus solution will not detect an MCP tool that has been modified to perform a function different from the one described. This demands a completely different approach to protection, designed specifically for the context of AI agents operating in connected environments.
Another point that experts highlight is the cascade effect a compromised MCP server can have. Because MCP was designed to be the central link between the agent and multiple tools and data sources, compromising a single server can give an attacker simultaneous access to several different systems — databases, code repositories, internal communication tools, file systems. It is no exaggeration to say that a poorly protected MCP server can be the entry point for an attack of much larger proportions than most IT teams are prepared to contain. 🚨
Why MCP security is not the same thing as agent security
Here is an important heads-up: protecting MCP servers is vital, but it is not the full picture. Connecting through MCP servers is just one of many ways AI agents can reach the tools and data they need. Securing this layer goes a long way toward preventing tool poisoning, unauthorized access, and data leaks — but it is not enough on its own. Agents can still interact with other systems without using MCP at all.
This makes MCP security just one thread in a much broader tapestry of AI security. When you evaluate vendors offering protection solutions for MCP servers, it is important to assess them within this bigger context. It is worth checking how well they protect against MCP-specific interactions and risks, but you will still need additional controls to shield the entire AI ecosystem — so checking the level of integration with the rest of your security stack makes all the difference.
The firewall AI needs — and that is still being built
The good news is that the security community has already woken up to the problem. Specialized companies and independent researchers are developing solutions that work as a dedicated protection layer for traffic flowing through MCP servers — something that is starting to be informally called an AI firewall. A quick clarification is worth making here: this term currently has two meanings. One is the older firewall, supercharged by AI, that defends a network against conventional threats like malware and intrusions. The other, newer and the one that matters here, is the firewall built specifically to defend AI itself: its models, agents, and connected tools, against threats like prompt injection and data leaks.
The core idea is to create a control point that analyzes not just what is being transmitted, but the context in which that transmission is happening, identifying suspicious behavior patterns that a traditional security system simply cannot see. Some of the approaches being developed include semantic analysis systems for messages traveling between agents and MCP servers, capable of identifying malicious instructions even when they are disguised within apparently legitimate content.
Different companies are already betting on distinct paths. TrueFoundry’s AI Gateway offers governance at the infrastructure layer, with access control and auditing of interactions between tools and MCP agents. Cisco extended its AI Defense product to include agent-focused guardrails, MCP scanning, and real-time traffic inspection, designed to detect and block unsafe behaviors.
Check Point’s AI Network Firewall, launched in July 2026, takes a network-centric approach, weaving AI security into customers’ existing firewall infrastructure. It discovers MCP servers, inspects MCP traffic, and enforces policies around agent access, covering interactions from employees, applications, and agents with MCP and other external connections alike.
The bigger challenge, however, is that these solutions need to be implemented in an ecosystem that is already in motion. You cannot simply pause MCP adoption while security gets sorted out — companies are already using it, agents are already operating, and data is already flowing. This means any security solution needs to be able to integrate into the existing environment without creating significant operational friction, something that is technically much harder than building protections from scratch. 🛡️
What companies can do right now
While definitive solutions are still being finalized, there are practices that already make a difference in reducing the attack surface of MCP servers. The first is the principle of least privilege applied rigorously: each AI agent should only have access to the tools and data sources strictly necessary for the task it performs, with no extra permissions that could be exploited in an escalation attack. This sounds obvious, but in practice many MCP implementations still grant broad permissions for convenience — and convenience, in this context, is synonymous with risk.
Another important practice is active monitoring of agent behavior, with alerts configured to identify unusual patterns — like an agent that starts accessing resources it never accessed before, or that begins making an atypically high volume of calls to a specific server. This type of behavioral monitoring is different from traditional network monitoring and requires tools adapted for the AI context, but there are already options available on the market that can perform this analysis efficiently.
Finally, regular reviews of MCP tools and servers registered in the environment are essential. The MCP ecosystem is still very young, which means third-party tools come and go frequently, updates happen without much notice, and the supply chain of this ecosystem has not been consistently audited yet. Keeping an updated inventory of everything connected to the company’s MCP environment — and reviewing that inventory regularly — is one of the simplest and most effective ways to reduce the risk of an unpleasant surprise.
Security always falls behind when infrastructure scales at this speed, and MCP is following exactly that pattern. Right now, we are seeing vendors and organizations testing different solutions for an emerging problem — whether it is an AI-aware network firewall, infrastructure-layer governance, or dedicated guardrails. Which approach wins matters far less than the ability of teams to close this gap before an MCP-specific attack forces the issue. Artificial intelligence is here to stay, MCP servers are a central part of this story, and the security of this infrastructure will define much of what happens over the next few years in the field of enterprise AI. 🔒
