The Model Context Protocol won the year. It is now the default way to plug an agent into your CRM, your database, your ticketing system and half a dozen SaaS tools, and we have written before about why MCP matters for connecting business data to AI. What gets discussed far less is the other half of that story: every tool you expose over MCP is also a door, and some of those doors were shipped without a lock.
The numbers are not reassuring. When a security firm scanned popular MCP servers in early 2025, 43% had command-injection flaws, 22% allowed path traversal or arbitrary file reads, and 30% were exploitable through server-side request forgery, many with no authentication by default. By 2026 the problem was serious enough that the NSA and CISA published formal MCP security design guidance. In one enterprise survey, 88% of organizations reported a confirmed or suspected AI agent security incident in the prior year.
None of this means MCP is a mistake. It means MCP has to be treated like any other production integration, with the same suspicion you would give a public API.
Why MCP widened your attack surface
A plain chatbot can only talk. An MCP-connected agent can act: read a record, send an email, run a query, move money. That is the entire point, and also the entire risk. The moment an agent can call refundOrder or readFile, the interesting question stops being "what will the model say" and becomes "what can the model be tricked into doing."
