Is Your MCP Server Leaking Data? 253 Vulnerabilities Found in AI Agent Tools

Last Updated: October 14, 2026

Researchers tested 273 open-source MCP servers and found verified security bugs in 343 of the 3,405 tools they expose, across 118 of those servers. The bugs come from tools that do not enforce their own documented input rules, so an agent that passes model-generated arguments straight through can be steered into trouble. Treat every MCP tool as untrusted code. Validate arguments on the server side, scope permissions to the minimum, and log every call.

What the research found

Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith and co-authors published ToFu, a tool-aware fuzzing framework, on arXiv on October 9, 2026 (arXiv 2610.13651). According to the paper, ToFu evaluated 273 MCP servers containing 3,405 tools and identified verified bugs corresponding to CWE weakness classes in 343 tools across 118 of the servers. Reporting on October 13 summarised the total as 253 verified security bugs.

The core finding is about trust. According to the authors, real-world tools frequently fail to enforce their documented input semantics, which makes it unsafe to treat LLM-generated arguments as trusted. The large language model sits between the user and the tool, so a bad argument from the model is the same as a bad argument from an attacker.

Why this matters now

Ars Technica reported on an October 2026 structural flaw in how MCP handles trust when agents talk to each other, which hit agents from Google and other vendors. The two stories point the same way: the protocol makes it easy to connect tools, and the safety depends on each tool doing its own checking.

At Flowtivity we run MCP-connected agents on our own dual DGX Spark setup, so we treat tool arguments the way we would treat user input on a public web form. That is a working habit, not a theory.

A pre-deployment checklist for MCP servers

Use this before any MCP server touches production data. Each item maps to a failure the research describes.

• Validate every argument on the server. Enforce types, ranges, and allowed values inside the tool, not only in the prompt. The model's output is input you did not write.
• Allowlist the tools. Expose only the tools the agent needs for its task. Fewer tools means fewer ways to chain an attack.
• Apply least-privilege scopes. Give each server read-only access unless a write is required, and scope tokens to one system.
• Sandbox execution. Run servers in containers or separate users with no access to secrets they do not need.
• Log every tool call. Record the tool name, arguments, caller, and result, so an incident can be traced.
• Require approval for irreversible actions. Deletes, payments, and external messages should pause for a human.
• Scan tool descriptions. Check the text a server sends to the model for instructions that do not match the tool's stated purpose.

How to run the audit

1. List every MCP server your agents connect to, and the tools each one exposes.
2. For each tool, write down the input rules it documents, then test whether it enforces them with malformed and out-of-range arguments.
3. Fix or remove any tool that accepts what its documentation forbids.
4. Re-run the test after every server update, since the tool set changes.

Frequently asked questions

What is MCP?

The Model Context Protocol is an open standard that lets AI agents connect to external tools and data sources through a common interface. Each MCP server exposes tools that an agent can call.

How many MCP vulnerabilities were found?

According to ToFu's evaluation of 273 open-source MCP servers, verified bugs appeared in 343 tools across 118 servers. Reporting on October 13 summarised this as 253 verified security bugs.

Are MCP servers safe to use in production?

Not by default. Many tools do not enforce their own input rules, so server-side validation, least-privilege access, and logging are needed before production use.

What is the first thing to check in an MCP server?

Whether the server validates its arguments itself. Test it with malformed inputs and see whether it rejects them.