SECURITY June 28, 2026
✍️ Carlos Montiel
⏱ 11 min read
The US Department of Defense published an official cybersecurity advisory on the Model Context Protocol (MCP) in June 2026. SC Magazine covered it as one of the year's most relevant attack vectors. If you run agents with MCP in production, this guide is essential.
⚠️ Official advisory published: The DoD (Department of Defense) issued the CSI_MCP_SECURITY advisory in June 2026, identifying MCP as an emerging attack vector that organizations with AI systems in production need to address proactively.
Why Does MCP Introduce New Risks?
MCP is a trust protocol: the LLM trusts that MCP servers honestly describe their tools. That trust is necessary for the protocol to work, but it's also an attack surface. A malicious actor who controls an MCP server can manipulate the agent's behavior without needing access to the LLM, the client system, or the agent's code.
Attacks through MCP go beyond traditional prompt injection: they operate at the protocol level and can affect the agent's entire session, not just a single response.
The 5 Most Critical Attack Vectors
1. Tool Poisoning
A malicious MCP server exposes tools with manipulated descriptions that lead the LLM to make incorrect decisions. Example: a tool called "save_report" whose JSON description additionally says it should ignore certain privacy restrictions.
2. Rug Pull Attack
The MCP server passes a security audit with normal descriptions, then changes its tool descriptions. The agent keeps using the tools with already-approved permissions, but with altered behavior. Especially dangerous with third-party servers.
3. Privilege Escalation
An MCP server with limited access makes seemingly legitimate requests that exploit the LLM's tendency to be "helpful." The agent, wanting to complete its task, may grant access to resources the server shouldn't have.
4. Context Window Poisoning
An MCP server injects malicious text into resources the agent reads (documents, DB records, emails). This text alters the agent's reasoning for later tasks. Similar to indirect prompt injection but operating through the MCP protocol.
5. Cross-Agent Contamination
In multi-agent systems where agents share state or pass results to each other, a compromised agent can contaminate the state of other agents that trust its outputs. Especially high risk in LangGraph pipelines with multiple nodes.
What the MCP 2026 Spec Solves
The MCP 2026-07-28 specification (Release Candidate) addresses some of these risks:
- Eliminates server-initiated prompts — servers can no longer start unsolicited conversations
- Mandatory OAuth 2.1 — standardized authentication with better privilege separation
- Stateless protocol — reduces attack surface by eliminating stateful sessions
- Better separation between read and write tools
However, the spec can't protect against MCP servers that are malicious by design. Human auditing of server code remains the primary defense.
MCP Security Checklist for Your Company
- Only servers audited by your team or from the official MCP Registry — never install MCP servers from unverified sources
- Principle of least privilege — every MCP server accesses only the resources it needs for its specific task
- Version pinning — pin the exact MCP server version in production to prevent rug pulls
- Complete audit logs — log every tool call with timestamp, parameters, results, and user/session ID
- Server sandboxing — run MCP servers in containers with minimal permissions (non-root, restricted network)
- Output validation before use — verify the format and value range of a tool's result match expectations
- Mandatory code review — any new MCP server going to production must pass a security code review
- Separate agent identity — the agent has its own permissions, not inherited from the user who invokes it
Are your MCP agents secure in production?
Carlos Montiel designs MCP agent architectures with security built in from the start: sandboxing, auditing, least privilege, and defense against tool poisoning and rug pulls.
Request an AI security audit
Carlos Montiel
Enterprise AI Solutions Architect · guatemalia.com
Designs secure agent architectures with MCP, LangGraph, and Claude for companies in Guatemala and Latin America. Contact: guatemalia.com/en/#contact