All MCP security reports

ANSI escape sequences are terminal control codes: they change colors, hide text, clear the screen, move the cursor. A terminal renders them; a language model reads every byte. That gap lets an attacker hide instructions inside content an MCP server returns: a human reviewer sees an empty line or a tidy log, the agent sees the full directive.

The research demonstrates two variants against real servers. In direct-fetch AESI, a fetch tool relays attacker-hosted content carrying hidden codes straight into agent context. In stored AESI, the payload is written through one entrypoint and surfaces later through a different one, persisting across sessions and users. The cited precedents in kubectl and Git show the same class of bug predates MCP.

Sentry DSNs are routinely shipped in client-side code, and roughly 2,400 organizations expose theirs publicly. The researchers used those DSNs to submit crafted error events whose "Resolution" guidance embeds shell commands. When a coding agent pulls the telemetry to debug an issue, it treats the injected guidance as authoritative and runs the commands locally, under the developer's credentials.

The attack succeeded in 85% of trials across Claude Code, Cursor, and Codex, reaching environment variables, AWS keys, and GitHub tokens while bypassing EDR, WAF, and IAM entirely. Nothing is exploited in the software itself: the vulnerability is the agent trusting third-party telemetry relayed as tool output.

Cursor asked for approval the first time an MCP server was added, then never again. An attacker with write access to a shared repository could add a harmless-looking server, wait for a teammate to approve it, and silently swap the underlying command afterward. Every subsequent launch executed the attacker's payload with no new prompt.

The finding generalizes beyond one editor: approval flows that trust a manifest at install time are blind to what it becomes later. A tool definition that changes after review is the rug pull the MCP threat model keeps warning about.

MCP Inspector, the standard debugging tool for MCP developers, ran a local proxy with no authentication. Combined with a DNS rebinding technique, any malicious webpage a developer visited could reach the proxy and execute arbitrary commands on the machine. The flaw scored CVSS 9.4 and was fixed in Inspector 0.14.1.

The underlying lesson applies to servers, not just tooling: an MCP endpoint that answers sensitive methods without credentials is reachable by more callers than its author assumes.

A prompt injection planted in a public GitHub issue instructed any agent that read it to gather data from the user's private repositories and publish it in a public pull request. The agent held legitimate access to both; the injection only had to chain a sensitive read to an outbound write.

The researchers call this a toxic agent flow: no single tool is malicious, but the combination of a tool that reads sensitive data and a tool that can push it somewhere public turns one poisoned document into a data leak.

The research that put tool poisoning on the map. A malicious MCP server embeds instructions in a tool description that users never read but models always do, telling the agent to pass private data such as SSH keys or config files as hidden side effects of an innocent-looking call.

The demonstration exfiltrated a complete WhatsApp message history through a poisoned server that shadowed a trusted one, without the user ever invoking the malicious tool directly. Descriptions, not just tool behavior, are attack surface.