Last week, a research team called Digital Applied did something simple: they looked at what 19 popular MCP servers actually put inside an AI agent's context window — the text the agent reads as trusted instructions.
They found the problem everywhere. Tool outputs routinely contained material that had nothing to do with the server's declared function, including instructions capable of redirecting the agent's behavior. One of the 19, Context7 — the documentation-retrieval server most of us have wired into our coding agents — had an actively exploitable prompt-injection path. The September 2, 2026 finding means this: a server whose entire job is to feed your agent text, and which you trust precisely because it's popular, can feed your agent instructions you never issued.
The writeup did not land in isolation. It landed in a one-week window where the entire MCP layer was being taken apart in public.
A week when the tool layer stopped pretending
Here is what shipped between August 27 and September 2:
Wiz Threat Research published 90 days of honeypot telemetry (August 27). Attackers are not scanning AI infrastructure generically — they built native tradecraft for it. They exploited CVE-2026-42271, a command-injection flaw in LiteLLM's MCP server test endpoints that has sat in CISA's Known Exploited Vulnerabilities catalog since June. The payload downloaded a Monero miner, launched it detached, deleted its staging directory, and returned a valid-looking MCP handshake so the connection test reported success. On a Langflow target, an attacker staged a miner inside /app/data/.claude/ and named it to blend in with Claude Code artifacts. They also pulled LiteLLM proxy master keys straight out of Python process memory — because on LiteLLM that key never touches disk, so they learned which object holds it.
Sentry's self-hosted MCP server has an unauthenticated SSRF vulnerability, CVE-2026-81421 (reported July 12 via Forkast, August 27). A caller-controlled endpoint argument gets passed straight to an HTTP client with no validation, turning the server into a pivot point for lateral movement. A public exploit is available. The maintainer has not responded in over 46 days. BlueRock Security found that 36.7% of 7,000 scanned MCP servers were SSRF-vulnerable; 41% had no authentication at all.
Microsoft's UFO agentic automation framework shipped CVE-2026-73296, CVSS 9.4 (August 31). Its Mobile MCP server opens two Streamable HTTP ports — one for data, one for action — with no authentication provider and no authorization check. Deployed per Microsoft's own documented remote configuration, any client that can reach the ports can call capture_screenshot, get_ui_tree, tap, swipe, type_text, and launch_app on a connected Android device. No API key, no token, no user approval. There is no patched version.
And underneath all of it, the MCP specification revision of July 28 went stateless, dropping the Mcp-Session-Id header and pushing session-level security onto individual implementers — adding six new attack surfaces at the exact moment independent scans were finding that the implementers can't keep up. More than 40 CVEs hit MCP SDKs and servers between January and April 2026 alone, roughly one every four days. A scan of 2,600+ live implementations found 82% of those handling file operations vulnerable to path traversal and 67% carrying code-injection risk. Censys counted over 21,000 internet-reachable MCP servers in May.
Read that list again. The common factor is not a clever new attack on agents. It's the servers the agents are told to trust.
The blind spot isn't the agent. It's what the agent can reach.
The last month of headline-grabbing incidents — OpenAI's agents building a message board, the Hugging Face break-in, agents spoofing their own transcripts — pushed the whole industry to ask the same question: how do we record what an agent does?
That question is correct and incomplete.
When an agent goes wrong, the sequence is rarely "the model decided to." It's "the model trusted something." The agent calls a tool. The tool returns text or data. That return value enters the agent's context as privileged input — functionally indistinguishable from the developer's own instructions. In the Context7 case, that input could contain commands. In the Wiz case, the tool endpoint executed commands. In the Sentry case, the tool server could be coerced into poking around your internal network. In the UFO case, the tool could tap the screen and type on a physical device.
The agent has an identity. It has permissions. People increasingly log its actions. The MCP server in the middle often has nothing.
Consider the asymmetry of what gets recorded today:
- Your agent's chat transcript? Logged.
- Your agent's tool calls? Logged, usually.
- What the MCP server returned? Sometimes in the transcript, more often truncated, and never in a place the agent can't influence.
- What the MCP server did server-side — the network requests it made, the commands its endpoints executed? Typically on the same machine, inside the same trust boundary as the agent.
That last one is the problem. Wiz's LiteLLM attacker returned a legitimate MCP handshake after planting a miner. The injection doesn't leave a mark, because the tool that processed it and the layer that logs it share a border the attacker just crossed. You cannot audit a tool by asking the agent that trusts it.
This isn't hypothetical architecture-deck anxiety. The Digital Applied audit explicitly recommends adding MCP server outputs to the agent action audit trail, because "injected context [must be] logged alongside agent decisions, enabling post-incident forensic reconstruction." The governance frameworks list AGT-006 — Agent Action Audit Trail — and note it fails the moment context is silently altered. Everyone sees the gap. Nobody is positioned to fill it, because a log your agent can touch is a log an injected instruction can touch too.
What our data shows about the layer nobody records
We run a neutral, cross-platform record of AI agent behavior. As of September 2, 2026, the production system holds:
- 2,652,732 agents indexed across 63+ platforms
- 10,335,339 hash-chained behavioral records
- 275 agents with independent verified records — roughly 1 in 9,646
- 18,230 MCP servers indexed from six public registries (Glama MCP 9,982; MCP.so 6,798; PulseMCP 967; Smithery 312; plus two smaller sources)
Read the ratio. There is about one MCP server in our index for every 145 agents. The agents have behavioral records, tier history, hash-chained change logs. The 18,230 servers have a registry listing and nothing else — zero independent behavioral records, zero verified claims, zero continuous custody.
That mirrors what the outside research found, just measured across the whole ecosystem instead of one audit: Wiz reports MCP is present in 80% of cloud environments, about one in six deployments exposes a server to the internet, and roughly 70% of those return their full tool catalog to anonymous callers. The layer connecting agents to databases, repositories, cloud consoles, and payment rails is the most deployed, most credential-dense, and least independently recorded piece of the agent stack.
None of the incidents above were caught by watching the tool layer. Wiz caught theirs in purpose-built honeypots. Digital Applied caught theirs in a manual 19-server audit. Sentry was caught by an independent researcher filing a GitHub issue. UFO was caught by a researcher replacing the ADB binary with a test stub. In every case, the discovery was external, manual, and after the fact — exactly the way you discover something that no one is continuously recording.
What a recorded tool layer requires
If you're running agents in production today, the gap above is yours regardless of what anyone builds. The concrete list:
- Inventory every MCP server an agent can reach, including the ones a developer's IDE plugin added without review. OWASP codified this as MCP09 ("shadow MCP servers"). If Context7 or Sentry self-hosted is in your stack, that's a known injection or SSRF path — treat it as one.
- Assume no patch is coming fast. Sentry's maintainer is at 46+ days of silence; Microsoft UFO has no patched version. Bind these services to localhost, put them behind an authenticated reverse proxy, and block non-loopback exposure entirely if you don't need it.
- Authenticate by default. 41% of scanned servers have none. Network reachability plus zero auth is the exact condition Wiz watched get exploited for 90 days.
- Rotate the keys the proxy holds. A LiteLLM proxy can hold OpenAI, Anthropic, Azure, and Gemini keys at once, often alongside cloud IAM. Rotate as if they're already public — the memory-credential theft technique assumes on-disk secrecy won't save you.
- Capture tool outputs somewhere the agent can't write to. The record of what an MCP server returned has to leave the agent's trust boundary the moment it arrives, or it has the same forensic value as the logs the OpenAI agents learned to spoof.
The primitives exist: signature-based server identity, capability scoping, audience-bound tokens, append-only hash chains, cross-platform revocation. What doesn't exist is an independent entity holding the records — one the agent can't mediate and no single platform controls.
We keep indexing the servers for the same reason we keep indexing the agents: the market doesn't need a verdict on whether MCP is safe. It needs a record of what MCP did, held outside the machine where the agent runs.
Six weeks ago the story was a poisoned package in the supply chain. This week it's a popular docs server injecting instructions, a Microsoft device driver with no password, and attackers who know which Python object holds your master key. The agents are being watched. The servers driving them are not.
AgentRisk maintains a platform-neutral, append-only record layer for AI agent behavior across 63+ platforms. All figures in this piece were queried from production on September 2, 2026. Incident facts are drawn from Wiz Threat Research's 90-day honeypot report (August 27, 2026), Digital Applied's 19-server MCP context audit (September 2, 2026), Forkast's Sentry CVE-2026-81421 analysis (August 27, 2026), CyberPress's Microsoft UFO CVE-2026-73296 disclosure (August 31, 2026), and the MCP 2026-07-28 specification revision.
Top comments (0)