The Model Context Protocol did exactly what it was designed to do: it made it trivial to connect an AI agent to tools, files, and data. What the ecosystem did not do — fast enough — was treat that connection as a security boundary. An MCP server is code you did not write, running with your agent's authority, describing its own tools in free text your agent will read and act on. That is a supply chain, and in 2025–2026 it started getting attacked like one.
Three of the year's most consequential AI-agent flaws scored 8.7–9.6 — high to critical. Severity is not the whole story, but it signals how little friction stood between a connected tool and code execution.
The incidents, briefly
- CVE-2025-6514 (CVSS 9.6): a remote code execution flaw in widely deployed MCP infrastructure — the kind of primitive that turns a connected tool server into a foothold on the host running the agent.
- MCPoison / CVE-2025-54136: disclosed by Check Point Research on August 5, 2025, this targeted teams through shared repository MCP configurations — approve a config once, and a later silent swap runs different commands with the trust you already granted.
- CVE-2025-59536 (CVSS 8.7): a hooks-injection vulnerability in a popular coding agent, another instance of untrusted configuration reaching an execution path.
- LiteLLM PyPI backdoor (March 2026): the language-model gateway used by CrewAI, DSPy, Microsoft GraphRAG and others was briefly replaced with a backdoored build. It was live for roughly three hours and pulled about 47,000 times before removal.
Researchers have also catalogued the quieter, protocol-level problems that do not need a CVE to hurt you. The MCP tool-description field is an unsanitized instruction channel: a malicious or compromised server can hide directives in what looks like help text, and the agent follows them without the user ever seeing the payload. Work on Unicode TAG-block concealment showed those payloads can be made invisible in the approval view a human is shown, so the operator approves one thing and the agent executes another — an approval-view fidelity gap reproduced across multiple independent server implementations.
Tool descriptions, tool results, and configuration are all attacker-reachable inputs that an agent treats as trusted. Each is a place to inspect and mediate rather than pass through.
The exploitation (orange) ran ahead of the standards and regulation (green). By the time NIST opened its agent RFI and the EU AI Act reached enforcement, the CVEs were already public.
The pattern under the incidents
Strip away the individual CVEs and the same shape remains: the agent extends trust to a third party — a server, a package, a config, a tool description — at a point where nothing is inspecting what that third party actually said or did. Governments noticed; the defense community published MCP security design guidance in 2026, and the Cloud Security Alliance's research arm has run a series on tool poisoning and IDE auto-execution. One 2026 analysis estimated a single class of architectural flaw exposed on the order of 200,000 vulnerable instances across a supply chain of more than 150 million package downloads. The tooling shipped years ahead of the mediation.
Mediating MCP instead of trusting it
You do not secure MCP by asking developers to read every tool description or audit every server. You secure it by putting a mediation point between the agent and the tool, and making that point enforce a few unglamorous invariants. This is the MCP-inspect posture we build at Intertrace; the honest claim is not “safe” but “inspected, pinned, and fail-closed.”
- Inspect tool metadata, not just tool calls: scan tool descriptions and schemas for embedded instructions, hidden Unicode, and approval-view mismatches before the agent is allowed to use the tool.
- Pin and verify: treat MCP servers and gateway packages like dependencies — pin versions, verify integrity, and refuse silent config or version swaps, which is exactly the gap MCPoison exploited.
- Authorize at pre-action time: check the tool call that is actually about to execute against policy — the resource, the arguments, the tenant — rather than trusting an approval granted earlier for something else.
- Fail closed and record it: if the server is unverified or the inspection is inconclusive, deny; and log the decision as evidence so a compromised tool leaves a trail instead of a blind spot.