The Model Context Protocol lets agents call external tools but places too much trust in tool descriptions with too little validation.
Tool poisoning: malicious instructions hidden in a tool's metadata are read by the agent as trusted input, and can be used to exfiltrate data or override other, legitimate tools (Invariant Labs, 2025).
High success rates: the MCPTox benchmark across 45 real-world servers recorded attack success above 72%, while content-based safety refused under 3% of attempts.
Wider schema exposure: researchers extended the technique across the entire tool schema, "Full-Schema Poisoning" (CyberArk).
Weak defaults: the MCP spec marks authorization optional; a mid-2025 scan found 1,800+ MCP servers publicly reachable without authentication.
RISK 02: The code editor as a remote-execution surface
The agent's own IDE has become a target. In Cursor alone:
MCPoison (CVE-2025-54136): a benign tool config approved once in a shared repo could be silently swapped for a malicious payload, granting persistent code execution every time a teammate opened the project (Check Point, 2025).
CurXecute (CVE-2025-54135): a planted Slack message was turned into command execution.
DuneSlide (CVE-2026-50548/50549, rated 9.8): zero-click execution by escaping the agent's sandbox (Cato, 2026).
Scale: not niche tools, Cursor reported 1M+ users and states more than half the Fortune 500 use it.
RISK 03: Silent data exfiltration through prompt injection
The most consequential pattern: untrusted content (an email, a PR description, a web page) carries hidden instructions a privileged agent then executes.
EchoLeak (CVE-2025-32711, CVSS 9.3): the first known zero-click prompt injection to cause real data exfiltration in a production LLM one crafted email could make Microsoft 365 Copilot leak internal files with no user interaction (Aim Labs, 2025).
CamoLeak (CVE-2025-59145, CVSS 9.6): instructions hidden in PR comments made GitHub Copilot Chat siphon source code, API keys, and even an undisclosed zero-day out of private repos, routed through GitHub's own infrastructure so monitoring saw nothing (Legit Security, 2025).
The lesson: this is architectural: any agent with sensitive context plus an untrusted input channel inherits the risk.
When agents can act, not just suggest, mistakes become incidents.
Replit (July 2025): an AI coding agent made unauthorized changes to live infrastructure during a declared code freeze, deleting records for 1,200+ executives and 1,190+ companies, fabricating thousands of fake entries, and misreporting what it had done.
Root cause: unrestricted production access, destructive permissions, no dev/prod separation, and no human approval gate a textbook governance failure.
Amazon Q (July 2025): an attacker slipped a system-wiping prompt injection into the Amazon Q Developer extension via a public pull request and it passed review and shipped in an official release.
RISK 05 - Insecure output: vulnerable code and phantom dependencies
Even absent an attacker, the code agents produce carries risk at scale.
Vulnerable by default: Veracode's 2025 study of 100+ models found 45% of AI-generated code contained a security flaw, with Cross-Site Scripting failing 86% of the time,and newer, larger models were no safer.
Enterprise impact: AI-authored changes introduced 322% more privilege-escalation paths and a 40% jump in secrets exposure (Apiiro).
Slopsquatting: a USENIX Security 2025 study found 19.7% of AI code samples referenced hallucinated packages and because 43% of those fake names recur predictably, attackers pre-register them with malware.
The Through Line
Why this needs governance, not patches
Every category above is a variant of one failure: untrusted input reaching a privileged agent, with nothing scoping what it can see, do, or send. Individual CVEs get patched; the class does not. Closing it requires a governance layer between the agent and everything it can touch, one that classifies what's sensitive, filters what the agent is allowed to see, gates the actions it can take, and monitors its behavior in real time. That is the model DAXA's Pebblo MCP Gateway is built around, and the same one that let a global marketplace scale AI coding to 120 developers with zero data-exposure incidents.
