Thousands of Model Context Protocol (MCP) servers, software components that connect large language models (LLMs) to external systems, are leaving organizations exposed to high-impact attacks, a large-scale analysis shows.
Researchers scanned 9,695 MCP servers listed across popular hubs and directories and found systemic design and implementation weaknesses that transform convenient AI integrations into potent supply-chain risks.
The study cataloged 4,982 distinct issues across 5,832 affected servers, with 2,259 confirmed exploitable vulnerabilities beyond mere misconfiguration.
Critical classes of flaws were common. The researchers found 880 instances of arbitrary file access, 476 command-injection defects, 422 server-side request forgery (SSRF) bugs, 211 SQL injection vulnerabilities, and 490 denial-of-service weaknesses.
Top MCP Servers Exposed
Cross-site scripting, authorization bypasses, and prompt-injection behaviors also appeared, alongside 2,054 servers that lacked any authentication, an omission that amplifies the impact of other vulnerabilities.
The data indicates that flaws are not isolated: arbitrary file access frequently co-occurred with missing authentication, and feature-rich servers exhibited SSRF and prompt-injection patterns that enable attackers to both access sensitive assets and manipulate agent behavior.
MCP servers provide privileged bridges between LLMs and critical resources, file systems, databases, internal APIs, cloud services, and are central to so-called “agentic workflows” that let AI agents execute tasks autonomously.
That privilege makes MCPs attractive attack vectors: a single exploitable server in a widely deployed integration can serve as a lever for a broad compromise.
Researchers warn of “severity-weighted reach,” in which popular MCPs with multiple vulnerabilities pose outsized systemic risk because their exploitation can cascade across many organizations.
Surprisingly, the analysis found that common trust signals do not reliably predict security. Popularity metrics (GitHub stars), repository activity (commit counts), and even directory verification badges showed little correlation with fewer vulnerabilities.
High-popularity projects (50+ stars) often hosted complex integrations that increased their attack surface and, paradoxically, presented some of the most consequential vulnerabilities, such as SSRF and remote code execution via template or command injection.
Mid-tier projects (10–49 stars) accounted for the largest volume and diversity of flaws, while low-visibility repositories still harbored severe issues, including unauthenticated command execution.
Real-world implications were clear in domain-specific findings. In cryptocurrency and DeFi contexts, server-side template injection and prompt-manipulation flaws could enable remote code execution or economic manipulation.
Enterprise-focused MCPs that expose database connectivity showed SQL injection risk and unauthenticated Active Directory query capabilities, vulnerabilities that can be abused for reconnaissance or privilege escalation through natural-language-driven interfaces.
Root causes point to developer-introduced failures in input validation, inadequate authentication, and insecure defaults rather than coordinated malicious activity.
Prompt injection remains an emerging threat unique to LLM integrations: attackers can craft inputs or upstream prompts that coerce an agent into disclosing secrets, executing unintended actions, or bypassing safeguards.
The Trend AI study’s findings demand a shift from trust-by-default to a zero-trust stance for AI infrastructure. Practical mitigations include enforcing authentication and least privilege for all MCP endpoints, rigorous input validation and escape routines, parameterized queries to eliminate SQL injection risk, and isolation of local file and command APIs.
Additional controls, real-time traffic inspection, anomaly detection tuned for agentic behaviors, and continuous code audits are necessary to detect exploitation and reduce blast radius.
Organizations should also treat popularity and verification as insufficient signals and require standardized security assessments for any third-party MCPs.
As MCPs continue to underpin automation and LLM-driven workflows, security must be treated as integral design criteria. Without consistent secure-development practices and operational controls, the convenience of connecting models to the real world risks enabling large-scale exploitation across the expanding AI supply chain.
No Comment! Be the first one.