AI Governance Institute
← News
Research2026-08-21

91.8% of Audited MCP Servers Lack OAuth, Audit Finds

What happened

DeepInspect published findings in its MCP Security News Tracker: The 2026 Timeline of Model Context Protocol showing that 91.8 percent of audited Model Context Protocol servers were running without OAuth authentication. MCP servers act as the connective layer between AI agents and enterprise tools, data sources, and APIs, meaning that a server without strong authentication is effectively an open gateway for any agent or attacker that can reach it. Without per-server identity and explicitly scoped tool permissions, there is no meaningful barrier to an unauthorized agent invoking privileged actions, traversing connected systems, or exfiltrating data. The audit did not restrict itself to fringe or experimental deployments, suggesting the gap is widespread across production environments. This finding arrives against a backdrop of escalating MCP-specific security disclosures, including CVE-2026-11624: NIST Flags DNS Rebinding Risk in MCP Servers and the Exposed MCP Bridge in Ruflo incident, reinforcing that the MCP layer has become a primary attack surface in agentic deployments.

Why it matters

  • ·An MCP server without OAuth has no reliable way to verify which agent or user is making a request, which means any access control decision downstream of that server rests on an unauthenticated identity claim. This directly undermines non-human identity lifecycle controls and creates conditions for privilege escalation across the agent toolchain.
  • ·Regulatory frameworks increasingly treat unauthorized access resulting from weak authentication as a control failure attributable to the deploying organization, not just the vendor. Compliance teams relying on vendor-provided MCP integrations without independently verifying authentication posture are carrying unexamined authorization risk in their inventories.
  • ·The 91.8 percent figure suggests that missing OAuth on MCP servers is a default condition, not an edge case, which means the risk is likely embedded in most enterprise agentic deployments today. As agentic AI drives a 36% surge in disclosed vulnerabilities, leaving authentication gaps unaddressed materially increases the probability of a reportable incident.

Governance controls affected

AGT-009Agent and Non-Human Identity ManagementAGT-001Agent Permission BoundariesAGT-015Agent OAuth Scope Drift DetectionSEC-002AI System Access ControlsSEC-004AI API Credential Management

What to do now

  • ☐Inventory all MCP servers connected to enterprise agent workflows and confirm whether each one enforces OAuth or an equivalent strong authentication protocol.
  • ☐Require per-server identity configuration and explicitly scoped tool permissions as a condition of continued or new MCP server deployment, and document this requirement in your AI vendor contract standards.
  • ☐Add MCP server authentication posture as a mandatory field in your AI system intake and approval workflow, blocking deployment of any MCP integration that cannot confirm OAuth enforcement.
  • ☐Schedule a targeted review of agent credential configurations to confirm that credentials issued to MCP-connected agents are scoped to minimum necessary permissions and rotated on a defined schedule.
  • ☐Include MCP authentication coverage in your next agentic AI red-teaming exercise, specifically testing whether an unauthenticated request to any MCP server in scope can invoke a privileged tool action.

What to watch next

The volume of MCP-specific vulnerabilities disclosed in 2026 so far indicates that standards bodies and regulators are beginning to treat MCP security as a distinct governance category rather than a subset of general API security. Compliance teams should monitor whether the OWASP Top 10 for Large Language Model Applications is updated to explicitly address MCP authentication gaps, and track whether guidance from CISA or sector-specific regulators follows the pattern set by CISA's agentic AI guidance to impose binding identity requirements on agent tool connections. Organizations in regulated sectors should also watch for MCP authentication posture to appear as an audit criterion in AI procurement assessments as vendor scrutiny of agentic toolchains intensifies.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Standards2026-09-10

CSA Sets MCP Authentication Controls as Baseline Agent Security Requirement

The Cloud Security Alliance published updated guidance establishing that MCP server authentication flows must be treated as security-critical control points in enterprise agent deployments. The guidance requires authenticated remote server connections using OAuth 2.1 with PKCE and mandates server metadata validation before any authentication begins. Weak server discovery and uncritical trust in server-provided endpoints are identified as the primary attack vectors enabling metadata manipulation and unauthorized tool interactions.

Research2026-08-29

NHIMG Sets OAuth Registration Standard for AI Agent Identities

The Non-Human Identity Management Group (NHIMG) has published guidance requiring AI agents to be treated as non-human identities subject to explicit OAuth client registration before credentials are issued or refreshed. The guidance mandates publisher-controlled metadata, signed statements, or software attestations as prerequisites for onboarding any new agent OAuth client. Narrow scope assignment and pre-issuance verification are the central operational requirements.

Research2026-09-09

ChatGPT Artifactory Flaw Enabled Silent Cross-Session Data Theft from Gmail and GitHub

Check Point Research disclosed a covert channel in ChatGPT's internal JFrog Artifactory instance that allowed one user session to silently inject instructions into another user's session, exfiltrating data from connected services including Gmail, Google Drive, Microsoft Teams, and GitHub. The vulnerability stemmed from misconfigured container isolation and overly permissive credentials. Researchers described the attack class as a 'coerced insider' model, in which the LLM executes unauthorized tasks using the victim's legitimate credentials without their knowledge.