One in four MCP servers opens AI agent security to code execution risk
Noma Security whitepaper finds most popular AI Skills and many MCP servers carry high-risk capabilities, with state changes most prevalent.
Noma Security analyzed hundreds of popular MCP servers and Skills across eight risk categories, finding most widely used Skills carry at least one risky characteristic and a typical enterprise runs well over a hundred high-risk agent tools, with arbitrary code execution common across MCP servers. The most prevalent risk is the ability to change state or data, and named toxic combinations include ContextCrush data leakage, ForcedLeak via poisoned Salesforce CRM records, DockerDash supply-chain compromise, the Replit production database deletion, and the hijacked Amazon Q VS Code extension. Building on OWASP LLM06:2025, the paper proposes the No Excessive CAP framework of capabilities, autonomy, and permissions, recommending allowlisting, MCP version pinning, approval gates on irreversible actions, and user-scoped expiring credentials.
- One in four surveyed MCP servers exposes arbitrary code execution risk to AI agents.
- Half of MCPs with external communication also combine untrusted input and sensitive data access in the same toolset.
- Skills resist rug-pull attacks as static files, while @latest-pinned MCP servers silently pull new package versions.
- Recommends narrow allowlisted tools, pinned MCP versions, human approval for high-blast-radius actions, and delegated expiring credentials.
- Organizations
- Noma SecurityOWASP
From the original article
4 min read at helpnetsecurity.com
Enterprise deployments of AI agents lean on two extension mechanisms that introduce risk at different layers of the stack. MCP servers expose deterministic code functions with structured, loggable invocations. Skills load textual instruction sets directly into a model’s reasoning context, where their effect depends on conversational state and cannot be enumerated the way source code can.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.