Two independent security reports published the same week expose the Model Context Protocol's vulnerabilities from opposite ends: one finds the protocol specification itself is the attack surface, the other maps where that surface physically sits. Together they argue that MCP's governance deficit is not a bug backlog but a structural condition.
Why it matters
MCP has become the de facto wiring for agentic AI, letting models call external tools and data sources on demand. ClawSecure's AI Agent Threat Report, released September 24, 2026, ran live exploit reproductions against Linear, Notion, and Dropbox Dash and cracked all three3,4. The company says the gap "sits in the MCP protocol itself, not in any one company's code". Separately, OX Security Research analyzed 15,465 published MCP servers across three public registries and narrowed the dataset to 5,095 unique hostnames for infrastructure analysis5,6. Of those, 15.6 percent (796) resolved outside the United States, including 19 in China and 18 in Russia. The two reports converge on a single conclusion: the protocol ships connectivity without the identity, residency, or integrity controls enterprises already require of cloud vendors.
The big picture
ClawSecure found the same attack class across three separate companies' clean implementations of the MCP specification, which is why it places the flaw in the protocol rather than in a single product. On Dropbox Dash, ClawSecure cracked four of the five surfaces it tested; the fifth surface tested clean. In Notion and Linear, the platforms' own MCP servers automatically fetch attacker-controlled links the moment content is created, with no AI in the path2. "AI agents are already running finances, businesses, and critical systems, and every one of them can be hijacked by the content it reads," said J.D. Salbego, founder and CEO of ClawSecure. ClawSecure planted attacker-controlled credential bait on Linear's live production system in 75 minutes of unguided research.
The OX Security findings add geographic scope to the protocol-layer risk. About 0.45 percent of publicly listed MCP servers route traffic through consumer tunneling services, mainly ngrok-free. Another 2.3 percent of the hostnames no longer resolve at all, and six of those sit on expired domains available for purchase at prices between $4 and $12 a year. OX Security states that MCP "has no protocol-level concept of geographic region". Abandoned domains at single-digit prices represent a trivial acquisition cost for an attacker who wants to impersonate a formerly legitimate MCP endpoint.
OX Security also tested a trust-based prompt injection against Claude Code paired with Claude 3.5 Haiku. A malicious MCP server first asked for access to a harmless file, and the user approved it with an always-allow permission; the server then requested a sensitive file, including .env, and obtained it with no further prompt. Anthropic said that once always-allow is granted, that is the documented behavior. The company also said model-level detection of malicious content "is a best-effort heuristic, not a security boundary".
Between the lines
Previous MCP security discourse centered on specific implementation errors: OAuth credential theft in the Python SDK, coordination gaps identified at the MCP Dev Summit. The Cloud Security Alliance highlighted that the protocol's STDIO transport executes OS commands without sanitization, a design choice Anthropic has confirmed is intentional. ClawSecure's findings shift the conversation from patchable bugs to protocol architecture. If the specification itself permits servers to fetch attacker-controlled content on creation, no amount of vendor-side patching resolves the underlying design.
OX Security's framing reinforces the point from the infrastructure side: the standard "leaves open which parties operate a server, where it runs, what data flows to it, and whether the deployed code matches the published source". Remote MCP servers can run backend code that differs entirely from what their public repository shows1. Those four unknowns map onto the controls enterprises already require for cloud vendors: operator identity, data residency, data-flow auditing, and code-integrity verification. MCP provides none of them at the protocol layer.
MCP marketplaces compound the problem. OX Security compared the current state to Google's 2012 Bouncer scanner for Android apps: imperfect, but it existed. MCP marketplaces have no equivalent; anyone can write a server, push it, and publish it. MCP has surpassed 500 million monthly SDK downloads and nearly 16,000 public servers. That adoption velocity, paired with zero marketplace review, replicates the early mobile-app-store pattern at a scale compressed into under two years.
What's next
ClawSecure released its report in two volumes; Volume 1 covers the MCP platform layer, and a second volume is forthcoming. Every company named received coordinated disclosure before publication. With the protocol offering no native residency, identity, or integrity controls, integrators face the burden of layering their own allowlists, hostname verification, and model-tier policies on top of infrastructure that was not designed to enforce them. Anthropic's own characterization of model-level detection as "a best-effort heuristic, not a security boundary" makes the division of responsibility explicit: the protocol ships the pipe, and the integrator owns the locks.