The popular story about the Model Context Protocol goes something like this: a messy new technology grew up, got standardized, and became reliable plumbing. Mission accomplished. I want to argue the opposite. MCP becoming boring is the most dangerous thing that has happened to it, because boring things stop getting checked.
If you are new here, let me back up. MCP is an open standard from Anthropic that lets AI agents connect to outside tools and data: your files, your calendar, your company database, a web browser. Think of it as a universal adapter. Before it existed, in 2024, every AI framework had its own way of calling tools and its own way of coordinating agents. The protocol ecosystem went from chaos to structure remarkably fast, and MCP won the popularity contest. It is still the more widely adopted protocol for agentic systems, especially where teams need standardized access to tools and data sources.
Adoption turned routine rather than experimental. Teams picked their setups and moved on. That sounds like maturity. In security terms, it means an enormous number of installations that nobody is actively watching.
What the 2026 numbers actually say
In April 2026, researchers disclosed systemic design flaws in MCP. Not a single bug in a single product, but problems baked into how the thing works. The scale is the part that made me sit up:
- An estimated 200,000 vulnerable instances exposed.
- A supply chain covering more than 150 million package downloads.
- Independent 2026 scans found more than 12,000 MCP servers sitting on the public internet.
- Roughly 40% of those were running with no authentication at all.
That last one deserves a plain-English translation. An MCP server is the piece that hands your agent the keys to a tool or a data source. No authentication means no lock on the door. Anyone who finds the address can walk in and start asking the agent’s tools to do things. Four out of ten exposed servers, wide open.
Two specific issues anchor the disclosure. There is a critical remote code execution vulnerability in Flowise, a popular tool for building AI workflows visually. Remote code execution is the worst category of bug there is: a stranger gets to run their own commands on your machine. And there is a systemic command injection flaw in STDIO, disclosed by OX Security. STDIO is the simple text channel that many MCP setups use to pass messages between an agent and a tool. Command injection means an attacker slips instructions into that channel and the receiving system obediently runs them.
Why agent-to-agent makes it messier
Here is the structural problem that I find most under-discussed. Protocols have no memory. MCP and A2A, the agent-to-agent protocol that handles coordination between agents, are stateless communication standards. They move messages. They do not track what an agent did, what data it touched, or where its output went afterward.
For a single agent fetching a single file, that is fine. For a chain of agents handing work to each other, it is a visibility hole. Agent A asks Agent B for something, Agent B pulls data through an MCP server, and passes a result onward. If something went wrong in the middle, the protocol itself does not keep a record you can audit. Enterprise governance needs exactly that record, and the protocols were never designed to provide it.
Combine the three facts and the picture gets uncomfortable. Unauthenticated servers mean easy entry. Command injection means instructions get executed. Stateless protocols mean limited tracking of what happened next.
What non-technical readers should take from this
You do not need to understand STDIO to ask good questions. If your company is deploying agents, or you are evaluating a vendor that does, these are fair things to raise:
- Are any of our MCP servers reachable from the public internet, and do they all require authentication?
- Do we know which MCP packages we depend on, and whether they are on the affected list from the April 2026 disclosure?
- Are we running Flowise anywhere, and has it been patched?
- Since the protocols do not log agent activity, what layer are we using to track what our agents accessed?
None of this means MCP is a mistake. Standardization was genuinely useful, and a shared adapter beats fifteen incompatible ones. But “widely adopted” and “safe by default” are different claims, and the 2026 scan results suggest a lot of teams have quietly merged them.
The protocol stopped being news. The attack surface did not. Those two things drifting apart is where the risk lives, and closing that gap is ordinary, unglamorous work: inventory what you run, lock the doors, add your own logging. Not exciting. Worth doing this quarter.
🕒 Published: