Agentic AI
One in Five MCP Access Policies Broken or Missing, Security Gap Found
A review of Model Context Protocol integrations found widespread credential and authorization gaps, with over 20% of access policies either broken or absent entirely.
The New Stack
Rapid adoption of AI-assisted development is outpacing security practices. When developers build integrations on a whim—connecting AI assistants to APIs and messaging platforms without formal oversight—they often leave dangerous gaps in how those tools access production systems.
The Problem Identified#
A review of Model Context Protocol (MCP) integrations across customer and prospect environments found that more than 20 percent of MCP-related access policies were either broken or missing entirely. The majority of these servers were authenticated using personal tokens rather than service accounts, and none had documented credential rotation schedules or logs of their activities.
This discovery came months after the MCP specification itself underwent a major security revision on July 28, 2026—a sign that even the protocol's creators had to patch fundamental trust assumptions after seeing real-world usage.
How These Gaps Actually Materialize#
Tool descriptions become attack surfaces. Researchers at Invariant Labs demonstrated that GitHub's own MCP server could be compromised through poisoned issue descriptions—an attacker's text in a public issue was interpreted as instructions by the agent, which then used the victim's credentials to access private repositories. The MCPTox benchmark tested this vulnerability across 45 live servers and 20 models, achieving a 36.5 percent average attack success rate.
Permissions default to maximum access. Most MCP servers default to requiring full read, write, and admin permissions—not because they need all of them, but because that's what templates and tutorials demonstrate. Across the ecosystem, 88 percent of servers require credentials, yet only 8.5 percent actually implement OAuth. When developers do request credentials, they typically reuse existing admin-level keys from other projects rather than go through the bureaucracy of requesting narrower permissions.
Static tokens go unrotated and unwatched. Industry estimates suggest over half of MCP servers run on static API keys or personal access tokens that are rarely or never rotated. Vendor-provided implementations have shown the problem: Splunk's MCP Server app logged session and auth tokens in cleartext until patching in version 1.0.3 (CVE-2026-20205). In many enterprises, nearly half of AI activity runs through personal user accounts rather than dedicated service accounts, meaning a person's identity credential—not the system's—holds production access.
