AI Governance Institute
← News
Research2026-09-02

MCP Server Audit Finds Context Injection Across 19 Servers, Including Active Prompt Injection in Context7

What happened

Digital Applied published We Audited What 19 MCP Servers Put in Your Agent's Context, a first-party empirical review examining how MCP servers deliver content into agent context windows and whether that content includes unexpected or adversarial instructions. Across 19 servers reviewed, the audit found that tool outputs frequently include material beyond the declared function of the server, including content capable of redirecting agent behavior. A specific prompt injection vulnerability was disclosed in Context7, a widely used MCP server for documentation retrieval. The audit follows a pattern of MCP-specific disclosures that have accumulated throughout 2026, including 91.8% of audited MCP servers lacking OAuth controls and active exploitation findings from NIST's DNS rebinding flag on MCP servers. The core finding is that MCP servers represent an untrusted data source injected at a privileged position in agent workflows, and current enterprise onboarding processes do not treat them as such.

Why it matters

  • ·Context injection through MCP servers bypasses agent permission boundaries and prompt injection defenses that enterprises have implemented at the model layer, meaning tool-level controls are the missing piece and existing security architecture does not compensate for absent server-side vetting.
  • ·Any agent workflow that relies on MCP tool outputs without adversarial pre-testing is operating with an unverified input surface; in regulated industries, this creates traceability and accountability failures because the agent's reasoning and actions cannot be cleanly attributed when the context has been silently altered.
  • ·The Context7 disclosure puts enterprises using that server on immediate notice of a confirmed injection path, but the broader finding -- that unexpected context is a common MCP server behavior rather than an exception -- means the vendor due diligence obligation extends to every MCP server in the agent toolchain, not just one.

Governance controls affected

AGT-002Agent Prompt Injection DefenseAGT-010Agent Knowledge Source IntegrityAGT-019AI Tool and Plugin Supply Chain Risk AssessmentAGT-006Agent Action Audit TrailPRC-003Third-Party AI Model Evaluation

What to do now

  • ☐Compile a complete inventory of every MCP server currently connected to agent workflows, including those introduced by individual teams or developers without formal approval.
  • ☐Pause or isolate any agent workflows using Context7 pending review of the disclosed prompt injection issue and confirmation that a patched or mitigated version is in use.
  • ☐Establish a pre-onboarding review gate for MCP servers that includes adversarial context inspection: feed test prompts through the server and examine the full context returned to the agent before approving the integration.
  • ☐Update vendor due diligence questionnaires and contractual requirements to cover MCP server behavior, including disclosure obligations for any server-side instructions injected into agent context.
  • ☐Add MCP server outputs to the scope of your agent action audit trail so that injected context is logged alongside agent decisions, enabling post-incident forensic reconstruction.

What to watch next

Compliance teams should monitor whether the Context7 maintainers publish a formal patch and security advisory, and track whether other widely used MCP servers named in the Digital Applied audit receive similar disclosures in follow-on research. The accumulation of MCP-specific findings in 2026 -- spanning OAuth gaps, DNS rebinding, ANSI escape injection, and now context injection at scale -- signals that standards bodies and regulators may move toward formal MCP server security requirements; teams should watch the OWASP Top 10 for Large Language Model Applications update cycle and the MCP project's own sandboxing baseline for enforceable guidance. Enterprises that have signed onto voluntary AI safety commitments should also assess whether their current MCP posture is consistent with the tool integrity expectations embedded in those frameworks.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-08-26

CVE-2026-75130: A CVSS 9.0 MCP Bug With No Documented Fix

Security researchers at Digital Applied have documented a critical prompt injection vulnerability, CVE-2026-75130, in Context7 through version 2.1.2, scoring 9.0 on the CVSS scale. The flaw allows unsanitized content delivered through the MCP server to redirect connected AI coding agents. No vendor fix has been documented, leaving enterprises without a standard patch path.

Research2026-08-20

Check Point 2026 Report Maps Agentic Attack Paths Compliance Teams Must Govern

Check Point Research published its AI Security Report 2026 on July 14, documenting a shift in adversarial tactics from single-prompt attacks to multi-step exploitation of agentic AI architectures. The report identifies planted configuration files, indirect prompt injection, and agent session persistence as primary attack vectors. These findings have direct implications for enterprise controls governing agent permissions, credential management, and runtime guardrails.

Research2026-09-02

Canva's CISO: Default Trust in AI Agents Is an Enterprise Control Failure

Kane Narraway, CISO at Canva, argued in a recent episode of the AI Security Podcast that enterprises should not treat AI agents as trustworthy by default, particularly as vendor options proliferate rapidly. The commentary addresses how agent security, tool use, and third-party risk require defensive evaluation before any deployment proceeds. The episode offers CISO-level framing relevant to compliance teams building or reviewing agent governance programs.