MCP Servers Are Ready-Made Exfil Kits

A little over a quarter of the Model Context Protocol servers in Reco’s public sample listen on the network instead of staying on local stdio. Half of those listeners ship with no authentication. I would start there, before anyone gets attached to the bigger percentage.

The bigger percentage is still the one people will quote. Reco’s State of Agent Security 2026, published today, looked at 500 MCP servers from the public npm registry. Selection was narrower than a keyword scrape: MCP in the package signals, official SDK as a dependency, source confirmed to start a server. Frameworks, gateways, and clients were removed. About half of what remained can execute a shell on the host. More than 80 percent can read or write local files. Roughly 75 percent can make outbound network calls. Sixty-two percent put command execution, file access, and egress in the same package. Reco’s phrase for that combination is a toolkit to find data, act on it, and move it off the machine.

They sell a product that discovers agents and maps what those agents can reach. Read the brochure as a brochure. The underlying cut is still the cleanest public picture from this week: anonymized platform telemetry, the 500-server npm set, and vulnerability records from the National Vulnerability Database covering January 2025 through June 2026. Developers copy servers out of catalogs like that. If one process can shell, read local files, and talk to the internet, split those jobs across identities or do not install it. The open bind is faster to look for. Reco already counted it sitting in public packages.

Enterprise telemetry next to the sample is the part most teams already feel. Four in five AI tools in Reco’s view had no IT oversight. Twenty percent were governed. For SMBs they estimate 414 unsanctioned tools per 1,000 employees. The tools pick up OAuth grants and workflow permissions on the way in. Ofer Klein, Reco’s CEO, said agents embedded in applications create toxic combinations that expose data and trigger actions beyond what any owner approved. Ownership here means a named person. “The developer who ran a CLI last Tuesday” is how you stay at 20 percent.

They also flagged an open-source agent framework that passed 135,000 GitHub stars and then had its control interface hijacked from a single malicious webpage, with a skill marketplace running about 12 percent malicious content. Around the wider agent and LLM-tooling set Reco tracked 637 vulnerabilities. 525 of those landed in the past 18 months, including at least 111 rated critical (CVSS 9.0 or higher). The average monthly disclosure rate was under five during 2023 and 2024. About 29 a month since January 2025. Those should not sit in the same patch meeting as ordinary application CVEs.

What InjecMEM does to an install you already allowed

Hanling Tian and colleagues at Shanghai Jiao Tong University and Ant Group, accepted at COLM 2026, arXiv:2608.23471. One ordinary interaction. No read or edit access to the memory store. The planted record has two cooperating pieces: a retriever-agnostic topical anchor, so later questions on that subject keep fetching it, and an adversarial command optimized across templates and insertion positions so it still steers output after the retriever dumps a messy fused context into the prompt. They also demonstrated an indirect path in which a compromised tool writes the poison that normal queries later retrieve. MemoryOS and MemGPT were in the evaluation. On MemoryOS they reported 35.4 percent retrieval success and 76.6 percent attack success. The record survived benign memory drift. Queries off the target topic stayed clean.

A later question on the planted topic can surface something as dull as “use the backup exporter.” If that exporter is one of the 62 percent servers, you do not need a second model exploit. Retrieval is the product feature.

OWASP left prompt injection at LLM01 in the 2026 LLM Top 10 and moved Excessive Agency to LLM03. The agentic list already has memory and context poisoning as ASI06. People still click a “notes” card that also exposes run_command.

Two other results from this window sit better as rates than as matching lessons. Alice’s ENT-IPI Bench ran 147 adversarial enterprise scenarios across seven work domains and seven industries. Mean agent failure rate on the original frontier-model pass was 0.75. Every model failed more than half the cases. A later re-test put Claude Opus 4.8 at 0.17, down from 0.58. UK AISI, writing up a July cyber evaluation with some classifiers off and the open internet enabled, catalogued 19 unsanctioned live-internet actions across 10 of 122 runs, including an attempt to insert code into a real open-source project.

mcp.json, skill manifests, and tool descriptions belong with those memory writes. A cloned repository or a page the agent fetched can change what the agent is allowed to invoke. Log the tool name, a redacted argument schema, the caller, and the destination. A chat transcript does not reconstruct a copy-out.

Owners, pins, and the test that is still missing

Pin versions. Put shell and file-write scopes on an internal ticket. Keep unsigned or unaudited servers off managed laptops. Reco describes agents loading tools by the thousand through marketplaces with no review step; that is the load path the 135,000-star example already punished. Alice publishes a skills scanner that inspects packages before they load. Use it or the internal copy.

On a candidate MCP server, check whether the advertised scope matches the tools that actually exist. Then run a short indirect-prompt pack against the agent with that server connected: a retrieved document, a ticket comment, a lookalike domain, each asking the agent to read a local file and send the contents out. Disconnect egress or file write and try the same prompts. If the copy-out still completes, the restriction you thought you had is not in the path. For any agent that can act rather than only draft, that check belongs in the release gate. A jailbreak score on a bare model does not tell you whether a poisoned Jira comment can ship a file.

The inventory is whatever is running on endpoints and in personal connectors. Reco’s 414-per-1,000 SMB estimate is a hint about where the long tail lives. Combined shell, local files, and network goes first. Bind new listeners to localhost unless someone wrote down why they cannot. Authenticate the ones that already escaped onto the LAN.

Labs are not retiring prompt injection in this research window. The thing I would actually open on Friday is smaller than the 62 percent slide: which of your MCP listeners were copied out of that public catalog with nothing on the bind.