MCP Security Issues: Emerging Threats in 2025
Classic Attacks Exploit New Model Context Protocol: From Injections to Code Execution and Remote Control
To reduce development overhead and enable seamless integration between potential components comprising any given generative AI application, the Model Context Protocol (MCP) (Anthropic, 2025d) has recently been released and, subsequently, widely adapted. The MCP is an open protocol which standardizes API calls to large language models (LLMs), data sources, and agentic tools. Thus, by connecting multiple MCP servers–each defined with a set of tools, resources, and prompts–users are able to define automated workflows fully driven by LLMs. However, we show that the current MCP design carries a wide range of security risks for end-users. In particular, we show that industry-leading LLMs may be coerced to use MCP tools and compromise an AI developer’s system through a wide range of attacks, e.g., malicious code execution, remote access control, and credential theft. In order to proactively mitigate the demonstrated (and related) attacks, we introduce a safety auditing tool, McpSafetyScanner, the first such agentic tool to assess the security of an arbitrary MCP server. McpSafetyScanner uses several agents to: a) automatically determine adversarial samples given an MCP server’s tools and resources, (b) search for related vulnerabilities and remediations given such samples, and © generate a security report detailing all findings. Our work thus sheds light on serious security issues with general purpose agentic workflows, while also providing a proactive tool to audit the safety of MCP servers and address detected vulnerabilities prior to deployment.
Model Context Protocol (MCP) Vulnerabilities: Security Risks in AI Integration Systems
Understanding the Model Context Protocol
The Model Context Protocol serves as a universal standard for connecting AI models and agentic applications to various data sources and tools. Often described as the “USB-C port for AI applications,” MCP follows a client-server architecture where an AI application (host) connects via a client library to one or more MCP servers that provide access to specific capabilities such as file systems, databases, or APIs [link].
While this architecture theoretically introduces security boundaries where policies can be enforced at the protocol layer, researchers have discovered that these boundaries can be easily circumvented through various attack vectors. The protocol’s design, intended to enable powerful AI capabilities, has inadvertently created significant security risks that organizations must address.
The Core Architecture
MCP operates through a clear separation of roles: the host AI application connects to servers that expose specific capabilities through a standardized protocol. This design should theoretically allow for security policies to be enforced at the protocol layer, with each server restricting what resources it will provide regardless of what the AI model requests4. However, as recent research demonstrates, these architectural safeguards prove insufficient against sophisticated attacks.
Line Jumping: The Silent Backdoor in MCP
One of the most alarming vulnerabilities in MCP is known as “line jumping” (or tool poisoning), documented by security researchers at Trail of Bits. This vulnerability allows malicious MCP servers to execute attacks before any tool is even invoked, fundamentally undermining MCP’s security promises [link].
The attack vector works as follows: When a client application connects to an MCP server, it must query the server about available tools using the tools/list method. The server responds with tool descriptions that the client adds to the model's context. However, these tool descriptions themselves can serve as prime vectors for prompt injection.
Breaking Core Security Boundaries
Line jumping effectively undermines two fundamental security boundaries that MCP purports to establish:
- Invocation Controls: MCP’s “Tool Safety” principle should guarantee that tools can cause harm only when explicitly called with user consent. Line jumping bypasses this by injecting behavior-altering content into the model’s context before any tools are invoked.
- Connection Isolation: While MCP architecture should prevent cross-server communication and limit the blast radius of a compromised server, malicious servers can instruct the model to act as a message relay and execution proxy, creating an indirect bridge between supposedly isolated components.
Real-World Impact of Line Jumping
The real-world implications of line jumping include several dangerous attack paths:
- Code Exfiltration: Attackers can create MCP servers that instruct models to duplicate any code snippets they process. When a user shares code with any legitimate tool, the model silently copies this information to attacker-controlled endpoints without changing its visible behavior or requiring explicit tool invocation.
- Vulnerability Insertion: Attackers can inject instructions that affect how models generate code suggestions, causing the model to systematically introduce subtle security weaknesses that appear correct to users but contain exploitable vulnerabilities.
- Security Alert Manipulation: Attackers can instruct models to suppress or miscategorize specific security alerts, creating blind spots to particular threat categories on production systems.
WhatsApp MCP Exploitation: A Case Study
Researchers at Invariant Labs demonstrated how untrusted MCP servers can attack and exfiltrate data from trusted systems, using WhatsApp as a case study. Their experiments highlight two concerning attack scenarios3:
- Malicious MCP Server Takeover: When an agentic system (like Cursor or Claude Desktop) is simultaneously connected to both a trusted WhatsApp MCP instance and an attacker-controlled MCP server, the malicious server can deploy a “sleeper” MCP server that initially appears innocuous. After user approval, it switches to malicious tools that shadow and manipulate the agent’s behavior with respect to the WhatsApp MCP.
- Message Injection Attack: Even more concerning, researchers demonstrated that no malicious MCP server installation is necessary in some cases. A simple injected message is sufficient to hijack an agent into leaking a user’s list of contacts, representing a lower barrier to exploitation.
Advanced Attack Vectors in MCP-Enabled Systems
Security researchers have identified three primary types of attacks that exploit MCP vulnerabilities:
- Malicious Code Execution (MCE): Attackers insert malicious code into a user’s system files through MCP access. Leading AI models like Claude have demonstrated vulnerabilities to these attacks despite having security guardrails. While some obvious attack attempts trigger safety measures, slightly modified versions successfully execute dangerous code.
- Remote Access Control (RAC): Attackers gain immediate remote access to the victim’s system through MCP vulnerabilities. MCE attacks have been demonstrated that allow RAC every time the victim opens a new terminal.
- Credential Theft (CT): Attackers exploit access to system files or environment variables, covertly extracting sensitive information from the victim’s system.
Retrieval-Agent Deception Attacks
A particularly concerning new attack vector is the Retrieval-Agent Deception (RADE) attack. Unlike direct prompt attacks, RADE works by corrupting publicly available data that ends up in the user’s vector database. The data contains hidden MCP-leveraging attack commands centered around a specific theme. When the user queries their database for information related to this theme, the attacker’s commands are loaded and executed6.
This approach represents a significantly higher threat level since the attacker no longer needs direct access to the victim’s system. Researchers have demonstrated end-to-end RADE attacks for credential theft using Claude Desktop, where an attacker corrupts a file about “MCP” with commands that search for environment variables containing API keys (like “OpenAI” or “HuggingFace”) and exfiltrate them6.
Mitigation Strategies and Tools
As these security vulnerabilities come to light, researchers are developing tools and strategies to address them:
McpSafetyScanner
Security researchers have introduced McpSafetyScanner, the first tool designed to assess the security of arbitrary MCP servers. Given a particular MCP server, this tool:
- Uses agents to automatically detect system vulnerabilities using the server’s features
- Searches knowledge bases for related vulnerabilities
- Determines remediations for all identified vulnerabilities
- Produces detailed security reports for MCP developers
To reduce development overhead and enable seamless integration between potential components comprising any given generative AI application, the Model Context Protocol (MCP) (Anthropic, 2025d) has recently been released and, subsequently, widely adapted. The MCP is an open protocol which standardizes API calls to large language models (LLMs), data sources, and agentic tools. Thus, by connecting multiple MCP servers–each defined with a set of tools, resources, and prompts–users are able to define automated workflows fully driven by LLMs. However, we show that the current MCP design carries a wide range of security risks for end-users. In particular, we show that industry-leading LLMs may be coerced to use MCP tools and compromise an AI developer’s system through a wide range of attacks, e.g., malicious code execution, remote access control, and credential theft. In order to proactively mitigate the demonstrated (and related) attacks, we introduce a safety auditing tool, McpSafetyScanner, the first such agentic tool to assess the security of an arbitrary MCP server. McpSafetyScanner uses several agents to: a) automatically determine adversarial samples given an MCP server’s tools and resources, (b) search for related vulnerabilities and remediations given such samples, and © generate a security report detailing all findings. Our work thus sheds light on serious security issues with general purpose agentic workflows, while also providing a proactive tool to audit the safety of MCP servers and address detected vulnerabilities prior to deployment.
This tool allows MCP developers to easily scan their servers for vulnerabilities and implement patches based on the provided remediations and guardrail best practices. For standard MCP servers vulnerable to the demonstrated attacks, McpSafetyScanner successfully identifies vulnerabilities and provides appropriate remediation guidance6.
Security Best Practices
Organizations implementing MCP should consider several security approaches:
- Zero Trust Principle: Treat each component and request as potentially untrusted until verified
- Enhanced Authentication: Implement robust authentication for MCP server access
- Connection Isolation: Carefully audit which MCP servers are connected simultaneously
- Tool Description Inspection: Sanitize tool descriptions before they reach the model context
- Security Monitoring: Implement detection systems for unusual model behavior patterns
Conclusion
The Model Context Protocol represents a powerful advancement in AI system capabilities, enabling models to interact with external tools and data. However, as highlighted by recent security research, its current implementation contains serious vulnerabilities that malicious actors can exploit to bypass security controls, exfiltrate data, and execute unauthorized code.
The “line jumping” vulnerability in particular demonstrates that MCP’s core security principles can be fundamentally undermined, as malicious servers can attack before any explicit tool invocation occurs. The growing sophistication of attacks, particularly RADE attacks that don’t require direct system access, highlights the urgent need for improved security measures in MCP implementations.
As MCP adoption grows, organizations must carefully assess the security implications of connecting AI models to external data sources and tools. Implementing comprehensive security monitoring, strict access controls, and keeping systems updated with the latest security patches will be essential to mitigating these risks. Tools like McpSafetyScanner offer promising approaches to identifying and remediating vulnerabilities in MCP deployments.
Summary: MCP Tool Poisoning Attacks — Critical Vulnerability in AI Agent Systems
Key Findings:
- Vulnerability Discovered: Invariant Labs identified a critical security flaw in the Model Context Protocol (MCP), a widely used system for AI agent tool integration (used by Anthropic, OpenAI, Zapier, Cursor, etc.).
- Attack Method: Tool Poisoning Attacks (TPAs) allow malicious MCP servers to inject hidden instructions in tool descriptions, manipulating AI agents into:
- Exfiltrating sensitive data (SSH keys, config files, chat histories).
- Overriding trusted tool behaviors (e.g., redirecting emails to attackers).
- Concealing malicious actions behind benign UI representations.
Real-World Impact:
- Demonstrated attacks on Cursor, leaking credentials and private files.
- “Rug Pull” Risk: Malicious servers can modify tool descriptions post-installation.
- Shadowing Attacks: One rogue server can hijack tools from trusted servers.
Mitigation Strategies:
- Transparent UI: Clearly separate user-visible vs. AI-visible tool instructions.
- Tool Pinning: Lock MCP server versions to prevent unauthorized changes.
- Cross-Server Protections: Isolate dataflows between MCP servers.
- Guardrails: Use security tools (like Invariant’s platform) to monitor agent actions.
Call to Action:
- MCP’s current trust model is fundamentally flawed — clients and providers must implement stricter validation and user controls.
- Developers should treat agent tooling with supply-chain-level scrutiny (similar to PyPI/npm security).
About Invariant Labs:
A research firm focused on AI agent security, offering solutions like Guardrails to combat such vulnerabilities.
Read More:
- Follow-up post on WhatsApp data exfiltration (Apr 7).
- MCP-Scan security tool (released Apr 11).
Source: Invariant Labs Blog (April 1, 2025).
TL;DR: A major MCP protocol flaw lets attackers sneak malicious instructions into AI tools, stealing data or hijacking workflows. Clients like Cursor are vulnerable; fixes require UI transparency, version pinning, and cross-server safeguards.
This proposal outlines a mechanism to integrate OpenTelemetry (OTel) tracing capabilities into the Model Context Protocol (MCP). The goal is to address the “black box” nature of MCP server interactions within agentic workflows, enabling end-to-end observability for debugging, performance analysis, and system understanding. We propose adding a standardized way for MCP servers to emit OTel trace spans back to the calling MCP client, leveraging the existing protocol structure for notifications while adhering to open standards and maintaining semantic clarity between different observability signals.
