Since Anthropic introduced MCP, more than 10,000 public servers have come online. The SDK is downloaded 97 million times per month. ChatGPT, Claude, Cursor, and Copilot all support it.
Then security researchers started looking closely.
What they found is unsettling.
Tool Poisoning
This is currently the most common type of MCP attack.
The logic is simple: an MCP server exposes a set of tools to an AI client, each with a name and description. When the AI model decides to call a tool, it reads these descriptions to determine how to use it.
What if the description contains malicious instructions?
Attackers can embed hidden prompt injections in tool descriptions, causing the model to quietly perform additional operations while executing a normal tool — such as leaking user data to an external address or reading files it should not access.
Research from Adversa AI confirms that nearly all major MCP clients, including Anthropic, OpenAI, Cursor, and Zapier, are affected by this type of attack.
Resource Amplification
This one is more insidious.
A malicious MCP server can trick an AI agent into a tool-calling loop — each tool call triggers the next, nesting layer upon layer, without being visible from the outside.
Experimental data shows this attack can amplify the actual computational cost of a single query to 658 times the normal level without triggering standard security detection.
For users billed per token, this means bills can skyrocket without their knowledge.
Remote Code Execution (RCE)
The most severe.
Researchers have found multiple vulnerabilities with CVSS scores above 9.0, affecting hundreds of thousands of MCP installations. Exploiting these flaws allows attackers to execute arbitrary code on the victim's system — gaining full control.
Why Traditional Security Measures Fail
The root of the problem: the router in the MCP architecture is the LLM itself.
Traditional firewalls and RBAC (role-based access control) rely on static rules — checking IPs, paths, and permission tables. But LLM tool invocation is based on semantic judgment. You cannot use static rules to check whether a model has been persuaded to do something it should not.
The firewall does not recognize that a tool call happened because the model was injected with a prompt.
What Can Be Done Now
The security community has started to act:
- mcp-sec-audit toolkit: static and dynamic analysis, achieving 100% detection on the MCPTox benchmark
- SAFE-MCP framework: a community-led security standard (detailed coverage by The New Stack)
- Adversa AI publishes a monthly MCP security resource roundup; the April 2026 edition is out now
If you have integrated third-party MCP servers into production, now is the time for a serious assessment:
- Is that server from a trusted source?
- Are there any anomalies in the tool descriptions?
- Is there a mechanism to detect abnormal tool call frequency?
The pace of MCP adoption is far outstripping the maturity of security mechanisms, and this gap is turning into real risk.
Sources: MCP is Alive, but Faces Challenges (AI Business); Building With MCP? Mind the Security Gaps (The New Stack); CocoLoop, Top MCP security resources — April 2026 (Adversa AI); MCP Security: TOP 25 MCP Vulnerabilities (Adversa AI)