Researchers find 1 in 5 Model Context Protocol access policies are broken or missing

Prevalence of Broken Access Policies

Researchers discovered that one in five access policies within the Model Context Protocol (MCP) ecosystem are either broken or entirely absent. This finding highlights a widespread vulnerability in how AI-driven tools manage permissions and access controls.

Recent Protocol Overhaul

On July 28, 2026, the maintainers of the Model Context Protocol released a significant specification update focused on authorization. This update introduced issuer validation, issuer-bound client credentials, and Client ID Metadata Documents, acknowledging that the original trust model was insufficient for production environments.

Demonstrated Exploits and Attack Vectors

In May 2025, researchers at Invariant Labs demonstrated that GitHub's MCP server could be hijacked through a poisoned public issue. An attacker's text in an issue body was interpreted as an instruction by an agent, leading to the use of a victim's token to extract data from private repositories. A 2026 benchmark, MCPTox, tested this pattern against 45 live MCP servers and 20 models, revealing a 36.5% average attack success rate, with 72.8% against the worst-performing model.

Inadequate Scope and Authorization Practices

A common issue is the failure to properly define and enforce access scopes. Many servers request broad permissions (read, write, admin) even when only limited access is needed, often due to following basic tutorials. Across the MCP ecosystem, 88% of servers require credentials to function, yet only 8.5% utilize OAuth for secure authorization. This indicates a significant gap in implementing robust permission models, with many tools operating with overly permissive or undefined access.