Your AI agent has an API key, network access, and no concept of who is talking to it.
The Model Context Protocol has become one of the fastest-weaponized attack surfaces in enterprise IT. The specification defines OAuth 2.1 authorization — and explicitly marks it optional. An internet scan found at least 1,862 publicly reachable MCP servers answering unauthenticated requests.
WHAT ACTUALLY HAPPENED
Three vectors are seeing the sharpest growth: prompt injection that tricks an agent into invoking unauthorized tools, abuse of over-privileged MCP servers to pivot through internal networks, and steady leakage of sensitive internal context out of agent sessions.
The design detail that makes this hard: tool selection and invocation are mediated entirely by free-form natural-language descriptions interpreted at inference time. Anyone who controls text the model reads — a ticket body, a web page, a file name, a tool description — can influence agent behavior without ever touching your application code.
WHY THIS BREAKS THE USUAL CONTROLS
Traditional appsec assumes a boundary between code and data. An LLM agent has no such boundary. Instructions and content arrive through the same channel and are evaluated by the same process.
So your WAF sees a legitimate request, your IAM sees a valid service token, and your logs see a tool call that the agent was fully authorized to make. Every control passed. The decision to make that call was still planted by an attacker.
WHAT TO DO NOW
TREAT EVERY MCP SERVER AS AN UNTRUSTED THIRD PARTY — including internally built ones, and especially any you did not write yourself.
REQUIRE AUTHENTICATION EVEN THOUGH THE SPEC SAYS OPTIONAL — then scan your own perimeter for MCP endpoints answering anonymous requests before someone else does.
SCOPE AGENT CREDENTIALS TO THE SINGLE TASK — an agent holding broad standing tokens converts one prompt injection into full lateral movement across your estate.
PUT A HUMAN GATE ON IRREVERSIBLE ACTIONS — payments, deletions, production deploys and permission changes should never be a single autonomous tool call.
We spent twenty years teaching systems not to execute untrusted input. Then we built agents that read everything and decide for themselves.
Do you know how many MCP servers are running inside your network right now?