CYFIRMA Report Details MCP Exploitation Paths and Defenses

Summary

CYFIRMA’s 2026 report examines MCP tool poisoning, rug pulls, cross-server abuse and STDIO command injection, citing gateway exposures and agent-driven exfiltration cases. It recommends server allowlisting, least privilege, behavioral monitoring and input validation.

Key points

The report says malicious tool descriptions and instructions in retrieved content can direct MCP-connected agents to misuse tools and access across multiple integrated services.
It describes tool poisoning, post-approval rug pulls, cross-server contamination and STDIO command injection as distinct attack paths.
CYFIRMA reports a financial-services intrusion involving a rug-pulled tool that directed an agent to access documents and send them by email; the organization detected it after 14 days, without a SIEM alert or EDR event.
The report says more than 1,000 Clawdbot gateway instances were exposed without authentication, exposing credentials, API keys and conversation histories; it also reports subsequent credential harvesting.
Citing OX Security, the report describes official MCP SDK STDIO configuration being passed to the host shell without sanitization; OX Security reportedly confirmed command execution on six live production platforms.
The MCPTox benchmark tested 1,312 malicious cases against 45 MCP servers and reported an average attack success rate of 36.5% across tested models.
Recommended measures include MCP server allowlisting, least privilege, tool-description integrity checks, session-level activity monitoring, input validation and human approval for risky agent actions.

Article Details

Publisher: CYFIRMA
Report Period: Recent months through June 2026, including a Q1 2026 intrusion
Scope: MCP exploitation, security exposures, and defenses in agentic AI deployments
Key Statistics: CYFIRMA reports that more than 1,000 Clawdbot gateway instances exposed credentials and conversation histories in January 2026.
OX Security estimated that over 200,000 MCP instances were potentially vulnerable to the disclosed STDIO design issue.
In OX Security testing, nine of eleven public MCP registries accepted a malicious test server, and command execution was confirmed on six production platforms.
The MCPTox benchmark reported a 36.5% average attack success rate across its tested models, using 1,312 malicious test cases and 45 MCP servers.
A financial services intrusion was identified after 14 days through manual log review, with no SIEM alert or EDR event reported during that period.
Recommendations: Allowlist reviewed MCP servers, pin versions, and require security review of changes.
Apply least privilege and govern AI agents as privileged principals.
Log agent tool calls and correlate session-level sequences involving sensitive data access and outbound transfers.
Hash tool descriptions and review changes; flag credential references and cross-server instructions before they reach the model.
Validate STDIO configuration parameters before shell execution and enforce authentication and trusted proxy configuration on exposed gateways.