● Covered by 1 source · 1 reportMedium impact1 neutral
MCP Security Focus Shifts to Permissions Overhaul, Not Infrastructure Flaws
Key points
- MCP security issues are rooted in permissions, not infrastructure.
- 76% of businesses report an increase in non-human identities.
- 74% of businesses use AI with standing credentials.
- Common attacks include tool poisoning and confused deputy problems.
Evolving Understanding of MCP Security
Anthropic's Model Context Protocol (MCP), widely adopted since late 2024 by major tech companies like Microsoft, Google, and OpenAI, is now considered critical infrastructure. Initially, teams implemented MCP by trusting default settings, similar to other integration standards. However, by 2026, the prevailing understanding shifted: the core security problem was not within the MCP infrastructure itself, but in the underlying permissions granted to AI agents.
The Permissions Problem
This re-evaluation means that traditional patching of server-specific bugs is insufficient. Instead, security now requires addressing why a server has access to resources it does not need. The SANS 2026 Identity Threats Survey, which polled over 500 security experts, found that 76% of businesses observed an increase in non-human identities. Additionally, 74% of businesses utilize AI systems that rely on standing credentials for independent operation. The survey also highlighted that less than 40% of businesses use protective measures like approval processes, sandboxing, or logging.
Real-World Vulnerabilities
Past incidents illustrate this permissions-based vulnerability. In May 2025, a prompt injection attack on a GitHub MCP server extracted private repository data. This occurred because the personal access token backing the server had permissions far exceeding its operational requirements. Days later, a logic flaw in an Asana MCP integration allowed cross-tenant access due to a lack of enforcement of isolation boundaries at the permission layer.
Recognized Attack Patterns
Security researchers categorize these issues into patterns such as 'tool poisoning,' where a server's tool description contains hidden instructions, and the 'confused deputy problem,' where an agent inherits more trust than its current task demands. The emerging solution focuses on compartmentalizing access rather than relying on improved scanning tools.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Security experts now understand that vulnerabilities in Anthropic's Model Context Protocol (MCP) stem from overly broad permissions rather than infrastructure bugs. This shift in understanding requires a re-evaluation of how AI agents access tools and data, moving towards compartmentalized access. The SANS 2026 Identity Threats Survey indicates a rise in non-human identities and AI systems using standing credentials, with insufficient protection measures in place.