I Poisoned My Own MCP Server in 5 Minutes. Here's How.

<p>In January and February 2026, security researchers filed <a href="https://www.heyuan110.com/posts/ai/2026-03-10-mcp-security-2026/" rel="noopener noreferrer">30 CVEs against

<h2> The Setup </h2> <p>MCP (Model Context Protocol) lets AI agents call external tools. Instead of just reading files and running bash, the agent gets structured access to APIs,

<h1> I Audited 9 MCP Servers and Found Critical Vulnerabilities </h1> <p>The Model Context Protocol (MCP) has exploded — 97 million monthly SDK downloads, 10,000+ servers, and

<p>Most API documentation is written for humans.</p> <p>MCP tool descriptions are different.</p> <p>They are read by the model that decides what to call next.</p> <p>That means

<p>There's a class of prompt injection attack that bypasses almost every AI firewall on the market — and it's sitting in the blind spot of your agentic stack right now.</p>

<h2> The Problem </h2> <p>The MCP ecosystem is expanding at an extraordinary pace. Anthropic, Microsoft, Google, AWS, and Cloudflare are all publishing official MCP servers.

<p>Here is an MCP server config. Nothing about it is unusual.<br /> </p> <div class="highlight js-code-highlight"> <pre class="highlight json"><code><span class="p">{</span><span

<p>Publishing an MCP endpoint is easy. Making it behave consistently across clients is where the work starts.</p> <p>We recently shipped a hosted MCP server for Minds, an