Unit 42 finds MCP server flaws

Palo Alto Networks' Unit 42 has spent months documenting how Model Context Protocol, or MCP, can turn an AI assistant into a pathway to external systems, files and web services. In recent research, the team described MCP as the layer that lets large language model applications invoke tools and retrieve data from outside systems, including databases, browsers and developer platforms. Microsoft, meanwhile, says Azure AI Foundry agents can connect directly to public and private MCP server endpoints, extending those agents with external tools and data sources. That matters because MCP is no longer a niche developer experiment. Palo Alto Networks said in a June 2025 security overview that adoption accelerated after Anthropic introduced the protocol in November 2024 and OpenAI said in March 2025 that it would adopt MCP as well. Microsoft’s current Foundry documentation shows the protocol is now built into agent workflows that can authenticate to remote MCP servers and review or approve tool calls. (paloaltonetworks.com) ### Why are security teams suddenly focused on MCP servers? Unit 42’s published work has focused on the trust model around tool-using agents. In a December research note on MCP sampling, the team said the protocol relies on implicit trust and lacks robust built-in security controls, creating openings for covert tool invocation, conversation hijacking and resource theft. In a separate report on web-based indirect prompt injection, Unit 42 said attackers can hide instructions in web content that an agent later treats as actionable context. (paloaltonetworks.com) The concern is broader than prompt injection alone. Palo Alto Networks said MCP standardizes how AI systems interact with external systems, but the actual execution still runs through traditional APIs and server-side code. That means classic application bugs such as command injection and server-side request forgery can sit underneath the AI layer while still being reachable through an agent. (unit42.paloaltonetworks.com) ### What did researchers say they found at scale? Equixly, whose findings have been cited by Akamai, said a month-long assessment of popular MCP server implementations found 43% contained command injection vulnerabilities, 30% were vulnerable to SSRF, 22% allowed directory traversal or arbitrary file read, and 5% had other security concerns. Those figures match the numbers circulating in incident-response and security discussions around MCP this week. (paloaltonetworks.com) The same body of reporting has framed those bugs as implementation failures in rapidly deployed MCP servers rather than proof that the protocol itself is irredeemable. Akamai’s review said recent MCP-related CVEs included remote code execution in Anthropic’s MCP Inspector and SSRF in a Markdownify MCP server. ### How do these flaws turn into real attack paths? Microsoft’s Azure AI Foundry documentation says agents can connect to any publicly accessible remote MCP server or to private MCP servers inside a virtual network. (akamai.com) Once connected, those servers can expose tools that the Foundry model can use. That architecture creates several concrete risks. An SSRF flaw can let an MCP-connected tool fetch attacker-chosen internal URLs or cloud metadata endpoints. (akamai.com) A command-injection flaw can turn a tool parameter into shell execution on the host running the MCP server. And indirect prompt injection can push an agent toward invoking those tools through malicious instructions embedded in a document, email or web page. ### Why are responders talking about logs, inventories and identity? (learn.microsoft.com) Incident responders tracking MCP abuse have argued that the forensic problem is different from a standard web-app compromise because the decision chain runs through prompts, model outputs and tool calls. Unit 42’s broader agentic-AI research has repeatedly emphasized prompt injection, long-term memory poisoning and autonomous cloud attack paths as part of that investigation challenge. (akamai.com) Microsoft’s Foundry guidance points to some of the operational controls defenders can use now: authentication to MCP servers, approval of tool calls, and private-network deployment for internal servers. Security teams examining this class of risk are also mapping where MCP servers are deployed and which agents can reach them, because those connections define the blast radius if a tool or server is abused. (unit42.paloaltonetworks.com) ### What should readers watch next? Palo Alto Networks continues to publish MCP and agent-security research through Unit 42, and Microsoft is expanding MCP support in Azure AI Foundry documentation and tooling. The next useful disclosures are likely to be vendor advisories, CVEs in widely used MCP servers, and incident reports that show how prompt content, tool invocation logs and identity controls held up during real investigations. (unit42.paloaltonetworks.com) (learn.microsoft.com)