|
In January, researchers at the security firm BlueRock took Microsoft’s MarkItDown, a popular open-source tool that turns documents and web pages into Markdown, and connected it to an AI agent the way it was designed to be connected, through the Model Context Protocol. Then they pointed it at a URL. The URL was the address of the Amazon cloud’s internal metadata service, the one that hands temporary credentials to whatever is running on the server. MarkItDown fetched it, as instructed, and handed back the keys.
This was not a Microsoft breach. BlueRock built the vulnerable server itself, on an older cloud configuration, and MarkItDown was doing exactly what it advertises: fetch a URL, convert what comes back. The tool’s whole job is to retrieve arbitrary things. That is useful when a trusted person on their own laptop asks it to summarize a webpage. It is a credential-exfiltration machine when an agent, acting on instructions that may have come from anywhere, can aim it at the cloud’s soft interior. The tool behaves identically in both cases; what moves is the boundary around who is allowed to point it.
That gap, between a tool built for local trusted use and the same tool wired into remote, multi-user, cloud-hosted agents, is the whole of MCP security right now, and MarkItDown is only the version you can see.
MCP is the standard that lets an AI agent discover and use outside tools: query a database, open a repository, send a message, run a command. Anthropic introduced it in late 2024, and by December 2025 the company counted more than 10,000 active public servers and 97 million monthly downloads of its software kits, with ChatGPT, Gemini, Cursor, Copilot and VS Code all speaking it. The NSA, in guidance issued in May, called MCP the “de facto standard” for how AI systems talk to services, then said the uncomfortable part plainly: “MCP’s rapid proliferation has outpaced the development of its security model.”
You can read what the NSA means in the specification itself, which states that “authorization is OPTIONAL for MCP implementations.” That reflects where MCP began. It was built as a way for a program on your own machine to reach tools you already trusted, with the security boundary at the edge of your laptop, and optional authorization made sense there. It makes less sense now that the same protocol is hosted on the open internet, which is what the industry has spent the past year doing.
How much of it is actually unlocked turns out to be genuinely hard to answer, which is a finding in itself. The cleanest measurement comes from an academic team that scanned the public internet this spring and published its results as a preprint, meaning the work has not yet been peer reviewed. The team validated 7,973 reachable MCP servers and found that 40.55 percent accepted tool commands with no authentication at all. Most looked like tests and demos. Not all: one was a live corporate system that let an unauthenticated stranger pull more than 5,000 customer records, names, emails, phone numbers and addresses, now filed as CVE-2025-61510. Forty percent is a lot of unlocked doors.
The scarier-sounding numbers arrive with an asterisk. BlueRock’s scanners, which read the source code of thousands of public MCP projects, flag roughly a third for server-side request forgery and more than 40 percent for command-execution paths. Those are real patterns worth worrying about, but they describe code that could be dangerous in the wrong deployment, not proof that a third of running servers can be robbed. And a second preprint, posted this week, ran the field’s security scanners across tens of thousands of servers and found they flagged nearly 97 percent as risky while fewer than half of the sampled alerts held up, with the scanners disagreeing about which servers were the problem. The instruments built to measure MCP’s danger cannot yet agree on what danger looks like.
So the connective tissue under the agent economy sits roughly here. Authorization is optional at the bottom. The tools are powerful on purpose, because a tool that can do nothing is useless. The deployments are inconsistently locked, the genuinely exposed ones are real but a minority, and the scanners meant to sort the safe from the dangerous are themselves unreliable. The NSA’s list of remedies, prefer maintained tools, sandbox execution, enforce least privilege, validate every input, keep an inventory, is sound and long, and every item on it is someone’s optional homework. The specification has since grown a real authorization framework and a registry that vouches for who published a given tool, and those are optional too.
|
