15,000 Public MCP Servers Found Vulnerable, Abandoned, or Sovereignty-Risky
What happened
Security research firm OX Security presented findings at OWASP Global AppSec USA 2026. The analysis covered more than 15,000 MCP servers listed on public registries and over 3,000 open-source AI projects. MCP, or Model Context Protocol, lets AI agents connect to external tools, databases, and services. It functions as the integration layer between an AI system and the systems it can act on. Researchers found three distinct risk categories. The first is remote command execution vulnerabilities that could allow attackers to run unauthorized instructions on a connected system. The second is abandoned servers whose ownership can be claimed by a malicious party who then inherits whatever access the enterprise previously granted. The third is data sovereignty risks from servers that transfer data across jurisdictions without clear controls. AI agents commonly inherit the full permissions of the user who deployed them. This creates insider-risk exposure when those agents connect to compromised or takeover-prone MCP servers. OWASP GenAI Security Project chair Scott Clinton, also speaking at the conference, reinforced that permission inheritance and insider risk from agent tool connections remain insufficiently governed across the industry.
Why it matters
- ·Enterprises deploying AI agents that connect to external tools via MCP servers may be exposing internal systems to remote command execution. This risk applies if those servers carry unpatched vulnerabilities. Most organizations lack a formal inventory of which MCP servers their agents use. Research on 253 MCP Server Bugs and Six Framework Bypasses Expose Agent Authorization Gap and NSA Names Tool Poisoning and Weak Credentials as Core MCP Security Risks has established this as a widening pattern, not an isolated finding.
- ·Abandoned MCP servers represent a supply chain takeover risk: if an attacker registers an abandoned server's domain or repository, they inherit the access permissions the enterprise previously granted that server, potentially gaining a foothold in internal systems without any credential theft.
- ·Data sovereignty concerns identified in the research create direct regulatory exposure for organizations subject to cross-border data transfer rules. MCP server connections may route sensitive data through infrastructure outside the permitted jurisdiction without the enterprise's knowledge.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- The next quarter will test whether compliance programs can keep pace with AI systems that breach containment, reshape capital markets, and enable fraud at a scale no prior control framework anticipated.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Commission an inventory of every MCP server your AI agents currently connect to, including servers introduced by developer tools and coding assistants, and confirm who owns and actively maintains each one.
- ☐For each MCP server in that inventory, verify that the original maintainer is still active and that the server has received security updates within an acceptable window; flag abandoned or unmaintained servers for immediate disconnection or replacement.
- ☐Review the permissions granted to each MCP server connection and enforce least privilege, meaning agents should only have access to the specific tools and data they need for their defined task, not the full permissions of the user who deployed them.
- ☐Ask your engineering or infrastructure team whether any MCP servers transfer data to systems located outside your approved jurisdictions, and determine whether those transfers comply with your cross-border data obligations.
- ☐Add MCP server connections to your AI vendor due diligence and change-management processes so that new connections require the same ownership, maintenance, and permission review before going live.
What to watch next
The OX Security findings are part of a growing body of empirical research on MCP server risks. Further analysis from OWASP's GenAI Security Project is expected as the project expands its practical guidance for AI agent security. Compliance teams should monitor whether regulators incorporate agent tool governance into existing frameworks. This includes frameworks such as the Five Eyes Guidance on the Careful Adoption of Agentic AI Services. Teams should watch whether those frameworks begin citing MCP supply chain controls as a named expectation. Guidance from the Singapore Model AI Governance Framework for Agentic AI on tool and plugin governance may also evolve in response to research of this scale. Organizations should track whether any abandoned-server takeover incidents move from theoretical to confirmed breach, which would likely accelerate regulatory attention.