MCP security: how AI agents get hijacked.

What MCP is, in one minute

The Model Context Protocol (MCP) is an open standard for connecting AI applications to the outside world. An AI app, the host, such as a chat app, a code editor or a custom agent, contains an MCP client. It connects to MCP servers, each of which offers tools (“create issue”, “send email”, “run query”) and data. The model reads each tool’s name and description and decides when to call it.

Anthropic introduced MCP in November 2024. By December 2025, when it was donated to the new Agentic AI Foundation under the Linux Foundation, the project reported more than 10,000 active servers and 97 million monthly SDK downloads, with support in the major AI assistants and coding tools (MCP blog).

That success is exactly why it matters for security. MCP turns an AI that can only talk into an agent that can act, and every server you connect widens what an attacker can make it do.

Where the attacks happen

Real cases from 2025

1. Tool poisoning

In April 2025, Invariant Labs showed that an MCP server can hide instructions inside a tool’s description. Users typically see a short summary; the model reads the whole thing. A harmless-looking “add two numbers” tool told the model to read the user’s SSH keys and configuration files and pass them along, while explaining its actions innocently. The same research described rug pulls, where a server changes a tool’s description after the user approved it, and shadowing, where one server’s description changes how the agent uses another, trusted server (Invariant Labs).

2. A toxic agent flow through GitHub

In May 2025, Invariant Labs showed an attack on the official GitHub MCP server. An attacker opened an issue in a victim’s public repository containing hidden instructions. When the victim asked their agent to look at open issues, the agent read the instructions, pulled data from the victim’s private repositories and published it in a pull request on the public one. No tool was broken; the agent was simply steered by content it read. The researchers noted that many users click “always allow” on tool confirmations, which removes the last check (Invariant Labs).

3. Client bugs that run code

In July 2025, JFrog disclosed CVE-2025-6514 in mcp-remote, a widely used helper that connects local AI apps to remote MCP servers. A malicious server could send a crafted authorisation address that ran a command on the user’s computer. JFrog rated it 9.6 out of 10 (JFrog).

4. A fake server that stole email

In September 2025, Koi Security found an unofficial npm package called postmark-mcp, a copy of a legitimate email server. After 15 clean versions, version 1.0.16 quietly copied every email it sent to an outside address. It had been downloaded about 1,500 times before it was removed (BleepingComputer). It was widely described as the first malicious MCP server found in the wild.

Why these attacks work

Every case comes back to two facts. First, anything the model reads can steer it: tool descriptions, issue text, emails and web pages all land in the same context as the user’s request. That is prompt injection, with tools attached. Second, agents act with the user’s access. If the token behind a server can reach every repository or mailbox, so can anyone who steers the agent.

Developer Simon Willison calls the dangerous combination the lethal trifecta: an agent with access to private data, exposure to untrusted content, and a way to send data out (June 2025). MCP makes it easy to assemble all three by accident: connect a mail server, a browser and a code host to one agent, and you have it.

A checklist for safe MCP use

1. Inventory every server. Know which MCP servers each team and each agent uses. Unapproved servers on developer laptops are the new shadow IT; see shadow AI discovery.
2. Prefer official servers and pin versions. Install from the publisher, pin exact versions, and review changes before updating, so a rug pull or hijacked package cannot slip in.
3. Read the full tool descriptions. Not the summary. Anything that tells the model to read unrelated files, hide its actions or call other tools is a red flag.
4. Use least-privilege tokens. One repository, one mailbox, read-only where possible. Never connect an agent with an administrator token.
5. Break the trifecta. Avoid giving one agent private data, untrusted content and a way out at the same time. Split tasks across agents with different access.
6. Keep humans in the loop for risky calls. Sending, deleting, paying and publishing should need confirmation showing the full action. Resist “always allow”.
7. Patch clients and helpers. MCP clients and connectors are software too, with their own vulnerabilities.
8. Log every tool call. Record which tool was called, with what input, for which user, so you can spot abuse and investigate it.

These map directly onto OWASP’s agentic risks: agent goal hijack (ASI01), tool misuse (ASI02), identity and privilege abuse (ASI03) and the agentic supply chain (ASI04).

How to test an MCP setup

An MCP security test looks at the whole chain: the servers and their descriptions, the tokens behind them, the content agents will read, and what a hijacked agent could reach. It plants instructions in issues, emails and documents, tries to chain tools together into data theft, and checks whether confirmations, logs and limits actually stop it. Our AI agent and MCP testing covers both OWASP lists and gives you transcripts of every successful chain.