Researchers Find 523 Security Flaws Across Public MCP Servers, Exposing AI Agent Risks

Security researchers have uncovered 523 security vulnerabilities across 326 publicly accessible Model Context Protocol (MCP) servers, highlighting the growing security challenges surrounding AI agent ecosystems.

The findings were produced using FlowGuard, a black-box security scanner specifically designed to evaluate MCP servers without requiring access to their source code.

The large-scale assessment examined approximately 8,000 publicly accessible MCP servers and revealed risks ranging from prompt injection and credential leakage to command injection and unauthorized filesystem access, demonstrating that AI-powered tool integrations are becoming an increasingly attractive attack surface for cybercriminals.

Researchers Find 523 Security Flaws

Model Context Protocol has rapidly gained popularity as a standardized framework that enables large language models (LLMs) and AI assistants to interact with external tools, applications, databases, and services.

Through MCP, AI agents can automatically discover available tools, invoke them using structured parameters, and process the responses returned by those services.

While this architecture significantly expands AI capabilities, it also introduces multiple security risks because every stage of communication between the AI model and external tools can potentially be abused if insufficient safeguards are implemented.

During the study, researchers analyzed the top 8,000 runnable MCP servers collected through MCPZoo, a repository aggregating publicly available MCP implementations from GitHub and MCP registries. Across these servers, FlowGuard identified 20,452 individual tools and executed more than 90,000 carefully designed probing requests.

The results showed that approximately 4.08% of the tested servers contained at least one security issue. Specifically, the scanner detected 161 prompt injection findings, 155 credential leakage issues, 129 command injection vulnerabilities, and 78 filesystem access risks.

Among all discovered weaknesses, command injection emerged as the most prevalent, affecting 115 servers. These vulnerabilities occur when attacker-controlled input can be incorporated into shell commands or subprocess executions without proper validation or sanitization.

Successful exploitation could allow attackers to execute unintended operating system commands, potentially compromising the underlying infrastructure hosting the MCP service.

Rather than relying solely on suspicious tool descriptions or parameter names, FlowGuard searched for concrete runtime evidence such as shell output, operating system identifiers, command execution traces, and backend error messages before classifying a finding.

Credential leakage represented another significant concern. Researchers discovered numerous instances where MCP tools returned security-sensitive information that extended beyond their intended functionality.

Exposed data included API keys, authentication tokens, cloud credentials, private keys, runtime environment variables, database secrets, and configuration fragments.

To reduce false positives, FlowGuard distinguished genuine backend-generated disclosures from reflected user input, placeholder values, or properly sanitized responses before reporting credential exposure.

The study also emphasized the increasing threat posed by indirect prompt injection attacks within MCP ecosystems. A malicious or compromised MCP server can intentionally return hidden instructions designed to manipulate an AI assistant’s behavior, influence future tool invocations, override the model’s objectives, or encourage unauthorized data exfiltration.

Researchers clarified that the 161 prompt injection findings indicate the presence of instruction-bearing content rather than confirmed exploitation.

Whether an attack succeeds ultimately depends on the AI model, host application, execution policies, and implemented safety controls.

FlowGuard follows a structured five-stage assessment methodology consisting of triage, reconnaissance, strike, analysis, and refinement.

The scanner initially evaluates tool names, descriptions, and JSON schemas to identify potentially dangerous parameters before issuing low-impact reconnaissance probes that reveal backend characteristics such as operating system conventions, programming language artifacts, and database technologies.

These observations are then used to guide targeted testing while deliberately avoiding destructive actions, persistence attempts, external network communication, or unintended state modifications.

Additionally, FlowGuard employs behavioral validation and source attribution techniques to ensure that only backend-generated evidence is reported, filtering out responses resulting from authentication failures, permission denials, or simple input reflection.

According to benchmark testing published on arXiv, FlowGuard achieved strong detection performance, recording F1 scores of 0.879 for command injection, 0.942 for filesystem access vulnerabilities, 0.864 for credential leakage, 0.995 for tool poisoning, and 0.957 for prompt injection.

Researchers also manually reviewed a representative sample of 100 servers and confirmed that 84 contained findings supported by concrete runtime evidence, while the remaining cases represented semantic risks or lacked sufficient proof of exploitability.

Despite its effectiveness, the researchers noted that FlowGuard remains a bounded black-box scanner and may not identify vulnerabilities requiring authentication, multi-step workflows, complex application states, or adaptive server behavior.

They recommend organizations perform comprehensive security assessments before integrating MCP servers, enforce the principle of least privilege, restrict filesystem and command execution capabilities, and continuously monitor AI tool ecosystems to reduce the expanding attack surface associated with AI-powered automation.