What Is MCP Security? The Model Context Protocol Security Framework Explained

AI agents are moving from chat windows into everyday work. They now read inboxes, query databases and act inside business apps. The plumbing that makes this possible is increasingly the Model Context Protocol (MCP), and MCP also opens a new attack surface inside the network many organizations still treat as trusted.

The risk is already measurable. Backslash Security looked at the 8,000 most popular MCP servers and found that 29% had at least one security risk finding. To help security teams sort the problem, the Coalition for Secure AI (CoSAI) published an MCP security framework that lists 34 threats across 12 categories.

This post covers how MCP works, how CoSAI groups those threats, and which defenses you already have versus which ones are new.

What Is the Model Context Protocol (MCP)?

MCP is an open protocol that lets AI applications connect to external tools and data. Think of it as a standard API layer for AI agents. Teams no longer need a custom integration for every system, because MCP gives agents one common way to discover services and use them.

An application can support MCP natively or through a separate MCP server. Either way, it exposes tools: specific actions an agent may call, such as searching a database, reading files or running a command. When an agent connects, it learns which tools are available and then calls them to complete a task.

Take an MCP server connected to your corporate email. It might let an agent read messages, answer customer questions and look up order details in an internal database. That is useful, and it is also a new pathway into the business.

Why MCP Creates a New Pathway Into the Enterprise

The trouble starts when the same agent that holds internal access also handles external systems and untrusted information: a customer email, a web page, a shared document. Any of these can carry content that the agent acts on. The result is a short list of outcomes every CISO already worries about:

• Data exposure: sensitive records leaving through an agent’s tools
• Unauthorized actions: the agent doing something nobody approved
• An expanded attack surface: a new set of identities, servers and connections to secure

The CoSAI MCP Security Framework: 34 Threats in Three Groups

CoSAI, an OASIS open project, catalogs 34 MCP threats in 12 security categories. The most useful part of the framework is how it splits those 34 threats by how new they are:

• 19 conventional threats: familiar security problems that apply to any system
• 8 MCP-contextualized threats: known problems that behave differently once AI agents and MCP are involved
• 7 MCP-specific threats: new ways to manipulate tools, influence agents and abuse the trust between connected systems

Conventional Threats: Old Problems, Bigger Blast Radius

More than half of the list is not unique to AI at all. It covers weak authentication, excessive privileges, insecure network configuration and poor credential management, the same issues you would flag on any server.

What changes is the speed, scale and autonomy of the system holding those weaknesses. Picture an agent that has credentials to internal file servers and also talks to customers through a chat app. If it reaches a malicious website or runs an unsafe command, an attacker can use that compromised agent as a way into the organization. The problem is old, but an autonomous agent can make the blast radius much larger.

The good news is that the defenses are familiar too:

• Least privilege access for every agent and MCP server
• Strong authentication policies for agents, servers and the users behind them
• Network segmentation so one compromised connection cannot reach everything
• Vulnerability management that includes MCP servers and their dependencies

You do not need to reinvent security for AI. You need to extend the controls you already run to these new systems.

MCP-Contextualized Threats: Familiar Attacks With an AI Twist

The second group has eight threats you will recognize, but each one behaves differently when an agent sits in the middle.

• Prompt injection. An attacker no longer needs direct access to an input field. They can hide instructions in a document, email or web page the agent processes. If the model treats that text as a command instead of data, it can take unintended actions with the agent’s permissions.
• Confused deputy. An MCP server uses its own elevated privileges to act for an agent or user who would not normally have that level of access.
• Resource exhaustion (“denial of wallet”). A cousin of denial of service. The attacker drives an agent to call expensive APIs or tools over and over, burning compute and running up real costs.
• Man-in-the-middle attacks on agent-to-tool traffic.
• Consent fatigue. Users approve so many agent requests that they stop reading what they are authorizing.

The fundamentals still hold. What changes is how you apply them: treat an AI agent as its own kind of actor, not as a traditional user or application.

MCP-Specific Threats: Seven New Ways to Attack AI Agents

The last group is new. These threats target how agents connect to external tools and what happens along that connection.

1. Identity spoofing: an attacker impersonates a legitimate agent or MCP client to reach a tool or resource.
2. Tool poisoning: malicious instructions hidden in a tool’s description trick the agent into actions nobody intended.
3. Full schema poisoning: the attacker changes a tool’s whole definition, adding hidden parameters or changing its behavior without the agent noticing.
4. Resource content poisoning: like prompt injection, except the malicious instructions arrive in content returned by the MCP server itself.
5. Typosquatting and confusion attacks: malicious MCP servers or tools are dressed up to look like trusted ones. In September 2025, Snyk reported that an npm package called postmark-mcp, which offered AI assistants a way to send email through Postmark, had added a hidden BCC that copied outgoing emails to an outside domain.
6. Shadow MCP servers: unauthorized or unmanaged servers running outside the security team’s visibility and controls.
7. Overreliance on the LLM: developers let the model make security decisions instead of enforcing access control in the underlying application.

The Common Thread: Trust and “Slop Security”

Every one of these threats comes back to trust. As agents get more capable, we let them do more for us, and over time we stop asking what they are doing or what data they are touching.

I call this slop security: we get so used to AI doing the work that we stop applying the scrutiny we would give any other application or user on the network. The way to secure MCP is to keep asking those questions. Know which agents and MCP servers exist, what each one can reach, who approved it, and what it is allowed to do on its own.

For the full walkthrough of the CoSAI framework, including the visuals for each threat group, watch What is MCP Security? The Model Context Protocol Security Framework on The CISO Perspective YouTube channel.

Sources:

• Backslash Security: MCP server security risks research (vendor research)
• Coalition for Secure AI (CoSAI): Model Context Protocol Security v2.0 (PDF)
• Snyk: Malicious MCP server on npm, postmark-mcp, harvests emails

Make sure to follow us across all platforms for more explainers on cybersecurity and emerging tech.