I have spent the last few weeks reading CVE writeups carefully: one after another, looking for the thing they have in common. The subjects are all new. mcp-remote. MCP Inspector. mcp-server-git. CrewAI. LangGraph. Cursor. Windsurf. Claude Code. Microsoft 365 Copilot. A year ago most of these did not have a CVE to their name. Between January and February 2026, security researchers filed more than 30 CVEs against the Model Context Protocol and its immediate ecosystem in roughly 60 days, and the count passed 40 by April. That is not a bad quarter for one project. That is a new attack surface announcing itself.
This post is my attempt to map that surface honestly. The free part below is the anatomy: what broke, why it broke, and the handful of root causes that explain almost all of it. It stands on its own, and every CVE in it is real and linked. The paid section at the end is the part I would hand a platform team on a Monday: a hardening runbook, a triage checklist that maps each vulnerability class to a specific control, and a worked example of locking down an MCP deployment. If you only read the free half, you will still leave understanding the shape of the problem.
Start with why these bugs feel different, because the difference is not cosmetic. In classic software, a path traversal flaw in a file download handler is a medium. Someone has to reach the endpoint, craft the request, and do something with the file they read. There are humans and network boundaries between the defect and the damage. An autonomous agent removes those boundaries. The agent reaches the endpoint, crafts the request, reads the file, and then acts on what it read, all in one uninterrupted loop, with the agent's own privileges.
Figure 1 shows the mechanism I keep coming back to. A piece of untrusted content enters at the top. The language model treats it as instructions instead of data. Those instructions become a tool call. The tool call executes in a runtime that holds developer credentials, the source tree, and a route to the internal network. Each arrow is a small, well-understood weakness. Stacked, they turn a moderate parsing bug into host remote code execution, and the agent is the thing that climbs the ladder for you.
Figure 1: The Amplification Stack
That is the thesis for everything below. The individual CVEs are mostly boring in isolation: injection, missing auth, path traversal, unsafe deserialization. The 1990s called and they want their bug classes back. What is new is that we wired these bugs to a component that reads attacker-controlled text, decides what to do, and has hands. The severity does not live in any one box. It lives in the wiring.
The Model Context Protocol is the USB-C of agent tooling. It standardizes how a model talks to external tools, and it won fast enough that a single design decision now echoes across hundreds of downstream projects. That is exactly why the core-infrastructure bugs matter most: they do not affect one product, they affect everything built on the pattern.
The clearest example is CVE-2025-6514 in mcp-remote, a proxy that lets a local client reach a remote MCP server. JFrog scored it 9.6. When the client connects to a malicious server, the server returns OAuth authorization-server metadata, and a crafted authorization_endpoint
value flows into a sanitizeUrlz
routine that does not actually sanitize before the value reaches an OS command. Connecting to the wrong server is enough. The package had over 437,000 downloads, and the fix landed in version 0.1.16.
Figure 2 traces that flow, because it is the template for a whole category. The client trusts the server it connects to. The server speaks a protocol field back. The field is treated as a shell-adjacent string. The string runs. Nothing here is exotic. The only novel part is that "connecting to a server" is now something an agent does dozens of times a session, often to servers a user found in a registry ten seconds ago.
Figure 2: mcp-remote Command Injection (CVE-2025-6514)
The pattern repeats one layer over. CVE-2025-49596, a 9.4 in Anthropic's own MCP Inspector, chained missing authentication on the proxy's API with classic DNS rebinding. A developer running Inspector locally could visit a malicious web page, and script on that page would reach the unauthenticated localhost proxy and run commands. Oligo reported it; Anthropic fixed it in 0.14.1 by adding origin validation and a session token. The lesson is old and keeps getting relearned: "it only listens on localhost" is not an authentication strategy when the attacker gets to run JavaScript in your browser.
The deepest version of the problem is not a single CVE at all. In April 2026, OX Security documented a command-execution weakness baked into the STDIO transport across the official MCP SDKs for Python, TypeScript, Java, and Rust. When a client configures a STDIO server, the SDK takes a command
field and launches it, without verifying the target is even an MCP server and without sanitizing the invocation. Configuration values become process execution. Because it is the same shape in four languages, a single class of flaw propagates to nearly every tool that uses the transport. Anthropic declined a protocol-level fix and updated the docs to say STDIO adapters should be used with caution, which tells you how hard this one is to close without breaking the thing that makes MCP useful.
Before the individual vendors blur together, it helps to see the terrain. The disclosures cluster into five groups, and each group fails in a characteristic way. Figure 3 lays them out around the thing they share.
Figure 3: The Five Agentic Attack Surfaces
Figure 3 is not just an org chart. Reading it clockwise is reading the trust gradient. Group 1 is protocol plumbing that everyone imports. Group 2 is first-party servers people assume are safe because a big name shipped them. Group 3 is the frameworks that give models code execution as a feature. Group 4 is the coding agents that sit on your credentials and source. Group 5 is the enterprise copilots that read your email without being asked. The severity climbs as you move toward the surfaces that combine privilege with automatic ingestion of untrusted content.
Table 1 collects the marquee CVEs so the scale is concrete rather than rhetorical. The thing to notice is not any single row but the column of severities: nine flagship entries, almost all critical, spread across every one of the five groups. This is a systemic surface, not a run of bad luck at one vendor.
Table 1: Marquee Agentic CVEs, 2025 to 2026
There is a comforting instinct to reach for the vendor's reference implementation and assume the vendor got the security right. The 2026 record says otherwise, and the two clearest cases are instructive because they broke in opposite directions.
Anthropic's own git server produced a three-CVE chain. CVE-2025-68143 let the git_init
tool create a repository at an arbitrary path because the configured repository boundary was never enforced, which means you could turn a directory like .ssh
into a git repo. CVE-2025-68144 passed user-controlled arguments to GitPython, so an attacker could inject --output=/path
into git_diff
and overwrite arbitrary files. CVE-2025-68145 let calls escape the configured repository path. Chain them, aim the file write at a .git/config
, and a poisoned README or issue description that the assistant merely reads becomes remote code execution. Anthropic ultimately removed the git_init
tool entirely in the December 2025 release.
The other case is scale. CVE-2026-27825 in mcp-atlassian, a server with over four million downloads, scored 9.1. Its Confluence attachment-download tools accepted an attacker-supplied target path and wrote files without confining them to a safe base directory. When the HTTP transport is exposed, often bound to 0.0.0.0
with no authentication, anyone network-adjacent can overwrite ~/.bashrc
or ~/.ssh/authorized_keys
with two unauthenticated requests. A companion SSRF (CVE-2026-27826) honored attacker-controlled Atlassian URL headers. Fixed in 0.17.0. The pattern across both: official servers optimized for usability first, and least privilege, path confinement, and network isolation came second or not at all.
Agent frameworks are where the amplification thesis gets literal, because their core feature is letting the model run code. When the model can be steered by untrusted input, that feature is an exploit primitive by default.
CrewAI is the cleanest illustration. CERT/CC published VU#221883 covering four issues. The headline, CVE-2026-2275, is a sandbox escape: the Code Interpreter tool silently falls back to a weaker in-process SandboxPython
environment when Docker is unreachable, and that environment does not block ctypes
, so an attacker can call arbitrary C functions and walk straight out of the sandbox. CVE-2026-2287 is the reason it triggers in practice, because CrewAI does not keep checking that Docker is alive, so losing Docker mid-session silently downgrades you into the vulnerable mode. Add an SSRF (CVE-2026-2286) and an unvalidated file read (CVE-2026-2285) and you have a full chain from prompt to host. The fix philosophy matters here: fail closed, do not fall back.
LangGraph shows the same story with a database instead of a shell. Check Point chained a SQL injection in the SQLite checkpointer (CVE-2025-67644) into an unsafe msgpack deserialization (CVE-2026-28277). Figure 4 walks the chain. A malicious metadata filter key injects into the checkpoint query, the injection adds a fake row whose checkpoint column carries a crafted msgpack payload, and when the application loads that corrupted checkpoint the payload deserializes into arbitrary Python. A third issue (CVE-2026-27022) reintroduces the same injection class in the Redis checkpointer. On self-hosted deployments this is full server takeover.
Figure 4: LangGraph SQLi-to-Deserialization RCE Chain
Figure 4 is worth sitting with because neither link is novel. SQL injection through an unparameterized filter is a first-week finding. Unsafe deserialization of untrusted bytes is a first-week finding. What is new is that persistent agent memory, the checkpointer, is the thing carrying the payload, so the attack rides the feature that makes long-running agents possible. And Langflow is the reminder that these are not theoretical: CVE-2025-3248, an unauthenticated 9.8 where a code-validation endpoint passed untrusted Python to exec
, sits on CISA's Known Exploited Vulnerabilities catalog and was used to spread the Flodrix botnet within hours of details landing.
Developer-facing agents concentrate everything an attacker wants in one process: source code, cloud credentials, package registries, and local execution. So it is not surprising that the coding-agent CVEs are the ones that read like heist plots. The common technique is indirect prompt injection, where the malicious instructions arrive inside content the agent ingests automatically rather than from the user.
Figure 5 abstracts the shape these share, because once you see it in one product you see it everywhere. An attacker plants content somewhere the agent will read on its own: a web search result, a repository file, an email. The agent ingests it. Hidden instructions get interpreted as commands. Those commands overwrite a sandbox binary or a config file. The result is host code execution or silent exfiltration, with no human in the loop to veto it.
Figure 5: The Zero-Click Prompt-Injection-to-RCE Pattern
Cursor's "DuneSlide" pair, CVE-2026-50548 and CVE-2026-50549, both scored 9.8 and both fit Figure 5 exactly. Cato Networks found that a poisoned web search result or a compromised MCP server response was enough for Cursor's agent to overwrite the cursorsandbox
binary, turning sandboxed commands into unsandboxed RCE. One flaw abused the working_directory
parameter on the internal run_terminal_cmd
tool; the other exploited a symlink-resolution fallback that trusted an unvalidated path when resolution failed. Patched in Cursor 3.0. Windsurf's CVE-2026-30615 was the one OX Security singled out as fully zero-click among the IDEs: attacker-controlled HTML could rewrite the local MCP configuration to register a malicious STDIO server, and commands ran with no further interaction.
Claude Code broke at a lower layer, which is worth calling out precisely because it is not prompt injection. CVE-2025-59536, an 8.7 that Check Point found, let a repository ship a .claude/settings.json
that executed shell commands on tool initialization, before the model reasoned about anything, by abusing project-level MCP auto-approval. Its sibling, CVE-2026-21852, let a malicious repo set ANTHROPIC_BASE_URL
to an attacker endpoint so Claude Code leaked the user's API key before showing the trust prompt. Configuration-level attacks like these are in some ways nastier than prompt injection, because they run with developer privileges before the AI even wakes up. They were fixed in 1.0.111 and 2.0.65 respectively.
The enterprise version of Figure 5 is the scariest because the untrusted content is a message anyone can send you. CVE-2025-32711, the "EchoLeak" flaw in Microsoft 365 Copilot that Aim Security disclosed, scored 9.3. An attacker sends an ordinary-looking email with a hidden prompt payload, white text or an HTML comment. Copilot retrieves that email into its RAG context while doing something unrelated, executes the embedded instructions, and exfiltrates emails, files, and chat content to an attacker server. No click. The exploit chained several bypasses, evading Microsoft's cross-prompt-injection classifier, defeating link redaction with reference-style Markdown, and abusing an allowed Teams proxy for egress. Microsoft patched it server-side. It is the clearest proof that any content an agent can read is content an attacker can use to steer it.
Strip away the product names and the same handful of causes account for nearly everything above. Missing input validation and unsafe command construction, especially around shell-out and the STDIO transport. Implicit trust in tool metadata and responses, which turns tool descriptions into an injection vector. Weak or absent authentication on local services that bind to localhost or 0.0.0.0
and assume the network is the boundary. Sandbox and isolation failures, where a code interpreter or workspace can be escaped through model-influenced input. Classic path and argument validation gaps that become critical the moment an agent can invoke them without a human. And supply-chain and configuration injection through malicious servers, registry entries, or project files.
Table 2 puts rough proportions on the MCP subset, drawn from the disclosure surveys of early 2026. The takeaway is the opposite of reassuring: shell and exec injection alone accounts for the plurality, and none of these are zero-days in the exotic sense. They are the bugs e…
