State of MCP Security 2026: the attack surface of agents becomes a standalone topic

In plain terms

A first dedicated report - « State of MCP Security 2026 » by Canopii - lists the vulnerabilities and bad practices of the Model Context Protocol ecosystem. The message is clear: security has not kept up with the pace of adoption.

The fact

Published on July 12, 2026 (Canopii PDF), the report analyzes public and private MCP servers and identifies several classes of weaknesses: exposed tokens/credentials, lack of server-side origin control, prompt injection via tool descriptions, unpinned dependencies, and permissive scope management.

Analysis

MCP exploded in 2025-2026 because it solves a real problem: connecting LLMs to tools without coding N integrations. But the speed of adoption has bypassed hygiene. Three patterns emerge:

1. Injection via tool description: the MCP server controls the text that the LLM sees - it can therefore push hidden instructions that hijack the agent. Classic, known, but few safeguards in public clients.
2. Coarse-grained credentials: many servers ask for an OAuth token with overly broad scopes, reused for all tools, without rotation.
3. Cross-server confusion: when an agent chains 5 MCP servers, no standard mechanism traces the origin of a tool result. A compromised server can feed another with instructions.

Under the hood

The report estimates (to be confirmed by third-party audits) that ~40% of the public MCP servers tested expose at least one secret key in their repo or default config, and that ~65% do not implement origin checks on calls. It proposes a 12-point checklist: strict version pinning, minimal scopes, signing of tool descriptions, on-demand logging, and sandboxing per server.

Scenarios

• Standardization (50%): Anthropic and OpenAI publish by Q4 2026 a "secure by default" MCP profile with cryptographic verification of tools.
• Fragmentation (35%): each client does its own hardening, the ecosystem splits into "public MCP" and "enterprise MCP".
• Major incident (15%): a visible breach forces the industry to accelerate - most likely scenario for Q1 2027.

So what

For a CTO deploying agents: treat MCP as third-party unaudited code. Sandbox per server, strict scopes, manual review of tool descriptions, monitoring of agent outputs. For an investor: the MCP security layer becomes a real market - expect to see 2-3 specialized startups raise funds within 6 months.

To watch

A hardened MCP profile published by Anthropic or OpenAI, a public CVE on a popular MCP server, and the first acquisition of an MCP-security startup by an established cyber actor.