MCP Issues

Connecting your AI to an MCP server lets a stranger into the room.

The Model Context Protocol lets an AI assistant use outside tools. But every server you connect gets to write text your model reads as instructions, can run code on your machine, and can call your other tools. None of this needs a bug. It is how the protocol works.

00 · Intro

What you're plugging into

A 60-second tour of the trust you hand a server the moment you click “connect”: its tool descriptions, its results, its sign-in flow, and its reach into everything else your AI can touch.

36.5%Average success rate of hidden-instruction attacks across 20 AI agents (MCPTox benchmark)
Sept 2025First malicious MCP server found in the wild: a lookalike package that copied every email
10 CVEsFrom a single April 2026 study of how local MCP servers launch code

The attacks

Each video shows two screens: the friendly chat you see, and what the model and the server are really saying to each other.

01 · Rug pull

The tool you approved turns bad later

Planned length: 90s

You review a server once and approve it. Later, the server quietly rewrites its tool descriptions. Your approval still stands, and the model now follows the new instructions.

Real case: the “Deadbugz” campaign (Aug 2026). A server behaved for three calls, then rewrote itself to hunt for SSH keys and cloud credentials and hide it from the user.
Defend
  • Pin the full tool definition, not just the name
  • Re-approve on any change
  • Pin exact package versions
02 · Tool poisoning

Hidden instructions in the tool description

Planned length: 75s

The model reads a tool's whole description. You usually see only its name. Instructions hidden there can make the model read files and slip them into a call.

Real case: Invariant Labs (Apr 2025). A simple “add” tool made an AI editor leak SSH keys, pushed off-screen with blank spaces so the user missed it.
Defend
  • Read every tool description in full before connecting
  • Scan with an MCP scanner
  • Use clients that show full call inputs
03 · Shadowing

A bad server hijacks your trusted tools

Planned length: 75s

One server's description can set “rules” for another server's tools, like “always BCC this address when sending email.” The bad server never even has to be called.

Real case: Invariant demos (2025). A rogue server redirected a trusted email tool and exfiltrated WhatsApp history.
Defend
  • Keep unknown servers in a separate session
  • Never mix them with email, files or messaging servers
04 · Lethal trifecta

Private data + untrusted text + a way out

Planned length: 90s

An agent that can read private data, reads content an attacker wrote, and can send data out can be turned against you. An unknown server supplies two of the three by itself.

Real cases: a poisoned public GitHub issue led an agent to copy private-repo data into a public PR (May 2025). A support ticket made an agent dump a Supabase database (July 2025).
Defend
  • Least-privilege, read-only tokens
  • Human approval for any write
  • Break one leg of the trifecta per session
05 · Fake package

The lookalike you installed by mistake

Planned length: 60s

Attackers publish packages with names close to official ones, ship clean versions to build trust, then add a backdoor in an update.

Real cases: postmark-mcp silently BCC'd every email (Sept 2025). Fake mcp-server-* npm names targeted agents (June 2026). A trojanized Oura server delivered an info-stealer (Feb 2026).
Defend
  • Install only the vendor's scoped official package
  • Pin exact versions, never @latest
06 · Connect = code execution

Just signing in runs the attacker's code

Planned length: 60s

A malicious server can hand your client a crafted sign-in address. Unpatched tools passed it to the operating system, which ran it as a command.

Real cases: mcp-remote CVE-2025-6514 (CVSS 9.6). MCP Inspector CVE-2025-49596. OpenCode sign-in flaw (Oct 2026).
Defend
  • Patch your client and helpers first
  • Never sign in to an unknown server from your main machine
07 · Phishing from inside the chat

The server asks you, or your model, directly

Planned length: 60s

Servers can pop up forms or login links in your chat (elicitation), and can ask your own model to write things for them (sampling), using your context and your tokens.

Real cases: a fake remote server phishing demo (MCP issue #544). Unit 42 showed sampling used to hijack conversations and write files covertly (late 2025).
Defend
  • Never type secrets into a server's form
  • Turn off sampling for untrusted servers
08 · Remote server risk

Everything you send, they keep

Planned length: 60s

A remote server sees every argument you send. It can log it, retain it, or be breached. A trusted vendor's server is only as safe as its hosting.

Real cases: Asana's MCP server leaked data across about 1,000 customers (June 2025). A hosting flaw at Smithery exposed a token controlling 3,000+ apps (Oct 2025).
Defend
  • Read the privacy and retention terms
  • Send the minimum data
09 · Defense

How to vet a server before you connect

Planned length: 90s

Who runs it, what it can reach, what it logs. If you can't answer all three, don't connect. If you must test it, do it in a sandbox with throwaway credentials.

Covers
  • Publisher checks and source review
  • Sandboxing and network limits
  • Pinning, auto-approve off, monitoring

Timeline

DateEvent
Nov 2024Anthropic releases MCP
Apr 2025Invariant Labs discloses tool poisoning, rug pulls and shadowing
May 2025GitHub MCP prompt-injection leak of private repo data (demo)
Jun 2025Asana MCP cross-tenant exposure · MCP Inspector RCE (CVE-2025-49596) · “lethal trifecta” named
Jul 2025Supabase MCP leak demo · mcp-remote RCE (CVE-2025-6514)
Aug 2025Cursor MCPoison (CVE-2025-54136)
Sep 2025postmark-mcp: first malicious MCP server found in the wild
Feb 2026Trojanized Oura MCP server delivers an info-stealer
Apr 2026OX Security stdio research: 30+ disclosures, 10 CVEs
Jun 2026Malicious mcp-server-* npm squats flagged
Jul 2026MCP spec 2026-07-28 tightens authorization
Aug 2026Deadbugz runtime rug-pull campaign
Sep–Oct 2026MCP Python SDK OAuth advisory · OpenCode sign-in RCE

Before you connect

Checklist

  1. Confirm the vendor links to this exact package or URL
  2. Read every tool description and parameter in full
  3. Check whether it asks for sampling, elicitation or broad file access
  4. Use a dedicated, read-only, short-lived token
  5. Run local servers in a container with no home folder access
  6. Limit network access to the one API it needs
  7. Keep it in a session with no email, files or databases
  8. Turn auto-approve off
  9. Pin versions and full tool definitions; re-approve on change
  10. Log every tool call

Don't connect if…

  • No verifiable link between the vendor and the package
  • The name is a lookalike of an official package
  • Descriptions talk to the model, mention other tools, or say “don't tell the user”
  • The install command pipes a script from the internet
  • It wants an admin or full-access token
  • It tells you to turn on auto-approve
  • The sign-in page is on an unexpected domain
  • It arrived in an unsolicited PR, DM or post
  • A remote server has no privacy policy or named operator