With over 10,000 active servers and 97 million monthly SDK downloads, Model Context Protocol (MCP) is by far the most popular agentic protocol currently on the market. While this is good news for developers who don’t want to write custom integrations for tools and third-party apps in their stack, MCP’s widespread adoption should be a cause for slight alarm for cybersecurity teams. Many cybersecurity teams still aren’t in the habit of thinking of their agents as part of their systems.

Since 2003, OWASP has been publishing top 10 lists detailing the most common security issues facing different types of architecture. They recently published a working draft of their MCP Top 10, a security framework that identifies common vulnerabilities affecting MCP servers, tools, clients, and agentic workflows.

While it’s still emerging, OWASP’s MCP Top 10 shares some alarming revelations, especially considering how popular MCP has become. With that in mind, we’ve done a deep dive into the MCP Top 10, digging into the vulnerabilities, showing some real-world examples to help give you an idea of what to look out for, and offering some MCP security best practices to prevent cybersecurity issues in your MCP ecosystem.

1. MCP01:2025 Token Mismanagement and Secret Exposure

Leaked credentials are always dangerous, but they become quite a bit more so in MCP. MCP sessions can be uniquely long-lived, so a lost or stolen token or API key can wreak havoc on a system. It also creates new risks, as the protocol itself can end up becoming a security risk. Your MCP environment might be vulnerable if your token or API keys are hard-coded into the MCP client or server, your models or agents are able to recall conversations, or records or logs of prompts are stored without redaction. In a case reported by researcher Thiago Goncalves, an AI assistant attached to an IDE ended up forwarding a copy of the access token to the attackers.

To protect against token mismanagement in MCP environments, start by storing your secrets in secure vaults like HashiCorp Vault or AWS Secrets Manager and then only use environment variable injection at runtime. Just-in-time privilege and real-time authorization grants also help to reduce risk, as they’re issued dynamically when they’re needed. Issuing short-lived tokens and restricting their scope to the specific agent or tool is another way to not only protect against compromised tokens and secrets but also to help keep damage to a minimum if an incident occurs.

2. MCP02:2025 Privilege Escalation and Scope Creep

Privilege escalation occurs when an agent’s privilege gradually expands over time, resulting in it being able to do far more than what it was originally intended. Developers often write agents with overly simplified read and write capabilities in order to make them easier to implement. Unfortunately, this also makes them easier to misuse. In the case of Microsoft & Anthropic MCP Servers, researchers found that overly-permissioned MCP servers could result in malicious traffic being able to access admin-level resources.

To help safeguard against privilege escalation, organizations and cybersecurity specialists should implement strict, fine-grained role-based access control (RBAC) as well as conduct periodic reviews to make sure that agent privileges remain as intended.

3. MCP03:2025 Tool Poisoning

Tool poisoning is when a cybercriminal attacks the metadata of an MCP tool, which an LLM interprets as legitimate commands. In June 2025, tool poisoning allowed hackers to inject SQL commands into support tickets using Supabase’s Cursor agent, which were then executed and exfiltrated into a public thread.

To avoid tool poisoning, you should treat all tool descriptions and output as untrusted input. Runtime inspection proxies can also detect anomalous behavior from an agent. Finally, making sure that tool manifests are cryptographically signed further protects against tool poisoning by verifying the manifest hasn’t been tampered with.

4. MCP04:2025 Supply Chain Attacks and Dependency Tampering

Supply chain attacks and dependency tampering occur when a third-party library, SDK, or plugin becomes compromised. This vulnerability can be especially insidious as many MCP servers are installed with package managers, which don’t require signature verification. Once installed, these servers are able to install backdoors, which can then leak sensitive data or otherwise compromise the MCP environment. This vulnerability allowed attackers to CC sensitive emails for several weeks using a compromised Postmark MCP server.

To protect against supply chain attacks and dependency tampering, start by hard-coding all dependencies to specific, verified versions. Requiring signature verification for all packages used by MCP servers and maintaining a private, curated registry of all dependencies also helps to prevent MCP servers from executing malicious code.

5. MCP05:2025 Command Injection and Execution

When an agent executes commands or scripts from raw data, command execution can occur. Because MCP servers tend to run on a local machine, command execution can result in attackers gaining full system privileges. This vulnerability allowed uninspected MCP servers to execute commands remotely.

To prevent command injection, developers should never allow MCP servers to execute raw code. They also need to inspect inputs vigorously. Finally, running MCP tools in a sandbox or containerized environment protects your system against a code execution vulnerability.

6. MCP06:2025 Intent Flow Subversion

When a cyberattacker embeds harmful instructions inside an agent’s context, intent flow subversion occurs. Instead of performing the user’s actual query, the LLM is instructed to execute the attacker’s goals, like ignoring security protocols or exfiltrating sensitive data. This vulnerability can be especially damaging in multi-step agentic flows, as context essentially acts as a secondary instruction channel that often falls outside of security protocols. It allowed attackers to insert malicious code into the GitHub MCP repository, which then instructed private LLMs to expose sensitive data.

To prevent intent flow subversion, start by separating user-provided instructions from retrieved data context using strict system-prompt boundaries, like specifying the LLM to follow the model’s instructions explicitly or breaking down prompts into structured data like a JSON, and implementing injection-pattern detection models that flag or block content containing harmful commands, like telling the agent to disregard previous instructions.

7. MCP07:2025 Insufficient Authentication and Authorization

MCP servers don’t always handle authentication and authorization properly. For exmaple, many don’t require mutual authentication, meaning that anyone who calls the tool is given access. This gives malicious attackers the ability to reuse tokens to perform attacks or to masquerade as an authenticated agent. In fact, 38% of MCP servers don’t require authentication of any kind.

If an MCP server doesn’t require authentication, attackers can manipulate internal tools simply by detecting an unprotected endpoint. In the case of CVE-2025-49596, a developer tool named MCP Inspector didn’t require authentication between components before version 0.14.1. This vulnerability let malicious actors execute stdio commands.

Implementing security protocols like OAuth 2.1 or mutual TLS for all inter-agent and agent-to-tool communications while ensuring that authorization decisions are enforced server-side for every request is both recommended as best practices for avoiding the insufficient authentication vulnerability.

8. MCP08:2025 Lack of Audit and Telemetry

Without a log, an organization isn’t able to tell when an MCP server’s been compromised. Most modern audit systems don’t monitor every tool invocation, change of context, or interaction between user and agent. Microsoft Azure cites an example where insufficient monitoring made it possible for attackers to leak sensitive data for weeks due to a lack of logs.

To avoid data breaches caused by a lack of auditing, organizations should implement an immutable logging platform, keeping track of all session metadata, tool invocations, and reasoning traces to give as comprehensive an overview of an agent’s behavior as possible.

9. MCP09:2025 Shadow MCP Servers

Shadow servers are unapproved, unmonitored MCP servers operating outside of official governance. They’re often created by developers for testing purposes, meaning they only use default login details. Because they’re unlisted with the company’s security system, they don’t receive security updates or active monitoring. This makes shadow MCP servers particularly vulnerable to cyberattackers. Although it also counts as a supply chain issue, a fork of the Postmark MCP server that made a copy of users’ emails to the developer’s server also counts as MCP09, as it was operating tools and performing actions outside of the organization’s security system.

To avoid shadow MCP servers, security teams should perform regular scans to identify all MCP servers that are currently running. Requiring a formal approval process for any new integrations and automatically decommissioning MCP servers that are no longer in use also helps ensure that no shadow MCP servers are compromising an organization’s cybersecurity.

10. MCP10:2025 Context Injection and Over-Sharing

When an agent, user, or session leaks sensitive data, context injection and over-sharing occur. If an agent’s working memory isn’t isolated, it can become a major security risk. Researchers from Zenity Research discovered a vulnerability in Microsoft 365 where cyberattackers could trick the agent into forwarding copies of a user’s sensitive emails via instructions hidden in a Microsoft Calendar invite.

To protect against MCP10:2025, developers should strictly enforce namespace isolation for context buffers between user and agent, automatically purge context between sessions, and use sensitivity-aware data classification to redact information before it enters an agent’s working memory.

Securing MCP Environments Against the OWASP Top 10

The OWASP MCP Top 10 demonstrates why cybersecurity experts need to be thinking about every aspect and component of their agentic ecosystems if they want to use MCP agents securely. Many of the vulnerabilities listed in the OWASP MCP Top 10 reveal how each AI agent increases the vulnerable attack surface by introducing autonomous decision-making and persistent access to tools, data, and third-party services.

As MCP adoption continues to expand, cybersecurity teams will need to stop treating MCP as an experimental playground. Going through the MCP Top 10 is a great first step towards ensuring your agentic ecosystems are secure, so you can focus on exploring MCP’s capabilities with a clear conscience.