Your AI agent just picked up a new set of hands. It can read your calendar, query your database, open pull requests, and send email. All through one protocol.
That protocol is MCP, and it is spreading through production stacks faster than anyone is securing it.
What MCP Actually Is
The Model Context Protocol standardizes how an AI agent connects to external tools and data. Anthropic introduced it in late 2024. By 2026 it has become the default way to give an agent something to act on.
There are three parts:
- A host, the application running the model (your IDE, your chat client, your agent framework)
- A client, the connector living inside that host
- One or more servers, each exposing tools the agent is allowed to call
When a server connects, it hands the model a list of tools. Each tool comes with a name and a natural-language description. That description is loaded straight into the model’s context.
Here is the part most teams never think about.
The model reads those descriptions and treats them as instructions.
At Zerotak, that single fact is where most of our MCP findings begin.
The Design Decision Behind the Risk
MCP folds together two things that older protocols kept apart.
REST and gRPC separate transport, authentication, and execution into distinct layers. MCP merges reasoning and control flow into one shared semantic context.
Tool descriptions, metadata, and executable instructions travel through the same channel. The model has no reliable boundary between “this is a description of a tool” and “this is a command to follow.”
That is not a bug to be patched out. It is a property of how the protocol carries context. Every risk below grows from it.
Tool Poisoning
This is the vector that matters most, and independent research through early 2026 agrees.
An attacker writes instructions into a tool description. The description quietly tells the model to read an SSH key, a config file, or a customer record, and pass it somewhere it should not go. The user never sees the instruction. A tool description is metadata. A person reads the tool name and clicks approve. The model reads the whole thing.
What makes poisoning different from ordinary prompt injection is persistence:
- It ships inside a package, a config file, or a remote server
- It fires on every invocation, in every session, for every user
- It needs no repeat delivery, unlike a phishing email that has to land twice
Testing across popular agents in 2026 found high success rates, and more capable models sometimes complied more often, because stronger instruction-following also means following the wrong instructions well.
Rug Pulls and Tool Shadowing
Approval is not permanent.
A server can change its tool definitions after you approve them. The tool you trusted on Monday can behave differently on Tuesday. That is a rug pull, and without version pinning it goes unnoticed. Tool shadowing crosses trust boundaries, which makes it worse. A malicious server’s description can change how the agent uses tools from a completely different, trusted server.
In one 2025 proof of concept, a harmless “fact of the day” tool exfiltrated a user’s entire message history through a separate tool the same user had also approved. One poisoned server. A different server’s data. No warning.
Confused Deputy and Token Problems
Most MCP servers act with their own privileges, not yours. When a server carries broad permissions and executes on your behalf, an attacker can borrow that authority. This is the confused deputy problem, and OAuth misconfiguration turns it into a one-line bug.
The June 2025 spec revision helped by classifying MCP servers as OAuth resource servers. The gaps that remain are mostly implementation, not theory:
- Over-scoped tokens. A server requests full mailbox access when it needs a single label. One stolen token, full blast radius.
- Token passthrough. A server accepts tokens that were never issued for it.
- Credential aggregation. A single server holds keys for Slack, GitHub, Postgres, and Salesforce at the same time.
- Missing authentication. CVE-2025-49596 let attackers run commands through unauthenticated MCP tooling, scored at CVSS 9.4.
Supply Chain
The first malicious MCP package reached public registries in September 2025.
Typosquatting, fake “official” servers, and poisoned dependencies are already in play. It is the same playbook that hit npm and PyPI, pointed at a newer, less-governed target.
Why a Standard Pentest Misses This
A conventional web application test maps endpoints, checks authentication, and probes for injection at the protocol level.
None of that reads a tool description. The payload here is not a malformed request. It is a paragraph of plausible English sitting in metadata that no human in the review chain ever opens. The input is semantic, not syntactic, so scanners built for one do not catch the other.
This is the surface Zerotak targets when assessing an agentic deployment, and it rarely overlaps with what a traditional scope covers.
What Actually Reduces the Risk
The unifying principle is short. Treat tool descriptions as code.
- Pin and hash. Record each tool description on first approval and re-prompt if it changes. This closes off rug pulls.
- Keep a registry. Approve servers explicitly and block everything else at the host level.
- Scope down. Short-lived tokens, least privilege, one server one job. No credential aggregation.
- Validate tokens. Check the audience claim on every request and never pass tokens through to backend services.
- Sandbox. One container per server, network segmentation, and no agent wired directly into production.
- Monitor at runtime. Watch what tools actually do, not only what they claim to do.
Zerotak works with teams deploying agents into real environments. We map every path where text reaches the model, treat each connected server as an untrusted component, and check whether an approved tool can reach data it was never meant to touch.
The protocol is not the enemy. Shipping it with the trust assumptions of a closed system is.
If your stack is adding MCP servers faster than it is reviewing them, that gap is worth closing before someone else finds it. Zerotak runs security assessments built for agentic and LLM-driven systems, not just classic web apps. Talk to us at contact@zerotak.com or visit zerotak.com.