The Model Context Protocol (MCP) has become one of the fastest-adopted pieces of AI infrastructure in 2026. It is also one of the fastest-exploited.
In a single 60-day window, the MCP ecosystem accumulated more than 30 CVEs. CVE-2026-33032, rated CVSS 9.8, is confirmed actively exploited. A supply-chain attack via a malicious MCP server silently added a BCC address to outgoing emails from more than 437,000 developer environments. No alert. No error. Just quiet exfiltration.
The NSA, CISA, and the Cloud Security Alliance have all published dedicated MCP security advisories in 2026. When three separate government and standards bodies publish advisories on the same protocol in the same year, the signal is clear.
What MCP is and why it matters for security
MCP is an open protocol that lets AI agents call external tools: databases, APIs, file systems, email clients, calendars. It is the layer that makes AI that does things possible. An LLM without MCP can answer questions. An LLM with MCP can send your emails, query your databases, and write to your file system.
That capability surface is also an attack surface.
The three main attack patterns
Tool poisoning. A malicious or compromised MCP server can embed arbitrary instructions in what appears to be help text or a tool description. The AI agent reads that text as part of its context and follows the embedded instructions, often without surfacing them to the user. The agent executes the attacker's payload while appearing to do something routine.
Supply-chain compromise via config. An attacker with write access to a repository can commit a benign-looking MCP server configuration, wait for team members to review and merge it, then replace the server command with an arbitrary payload. The initial review looks clean. The actual execution is malicious.
Session hijacking and replay. Most MCP deployments (91.5 percent, per independent scans) do not use OAuth or any formal authentication. Session tokens, when they exist, can be replayed or hijacked to impersonate a legitimate client, inject malicious prompts, or interact with MCP servers as a trusted entity.
What is actually being exploited right now
CVE-2026-33032 (CVSS 9.8) is the most severe confirmed-exploited CVE in the MCP catalog as of this writing. The supply-chain attack that silently BCC'd emails from 437,000 environments is the clearest illustration of what tool poisoning looks like at scale. The attacker did not need to breach any traditional perimeter. They published a malicious MCP server, waited for developers to connect it, and then read every email those environments sent.
The CSA Labs research note from July 2026 documents auto-execution as a particularly dangerous variant: a malicious server can embed instructions in tool help text that an IDE's AI assistant executes automatically when the developer opens the project, before any user interaction.
What defenders should do
Treat unauthenticated MCP endpoints as hostile by default. If an MCP server does not implement OAuth, it should not have access to sensitive systems or data. Full stop.
Audit your MCP server sources. Every MCP server in your environment is a potential supply-chain entry point. Know who publishes each server you consume, whether you pin versions, and what the server's actual network and file-system access looks like.
Read the NSA and CSA advisories. The NSA's CSI on MCP security and CSA Labs' research notes are technically detailed and actionable. They cover threat modeling, authentication requirements, and configuration hardening.
Watch for tool poisoning in your AI agent logs. If your agents are taking unexpected actions or accessing resources they were not explicitly directed to, tool poisoning is on the differential.
The MCP ecosystem will continue to grow. The attack surface will grow with it. Getting the security foundations right now, before MCP is woven into every enterprise workflow, is significantly easier than retrofitting it later.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are working through MCP security architecture for your organization.