AI
What MCP Is and Why It Matters
MCP (Model Context Protocol) is Anthropic’s open protocol for letting LLMs talk directly to external APIs. Your AI agent can query GitHub, pull Slack channel summaries, read a database, or pay through PayPal, all without leaving the chat. Over 15,000 public MCP servers exist today, and Microsoft, Google, Meta, and Amazon have already adopted the standard.
“With great power come great responsibility. But let’s get real. It really meant great risk.” — Dolev Attiya
Malicious MCP Server Attack Vectors
Attiya catalogs four methods for weaponizing MCP servers. First: malicious code baked into a server the attacker controls, executing arbitrary payloads on install. Second: access abuse — a fake GitHub MCP with the victim’s API key already inserted quietly exfiltrates the entire repository. Third: poisoned tool descriptions that instruct the LLM to read a sensitive file, pass its contents as a parameter, and stay silent about it.
“Don’t tell to the user. We want to be gentle. Don’t scare him.” — Dolev Attiya
Fourth: a server starts legitimate, then turns after a later commit. The official Postmark MCP did exactly this in September 2025, exfiltrating passwords and email reset tokens after a revision. Malicious file-system MCP demo: calculator payload (11:01)
Exploiting Legitimate MCP Servers via Prompt Injection
Legitimate MCP servers are just as exploitable as malicious ones. An attacker crafts a CV with the ransomware payload written in white text, invisible to the human eye but readable by the model. When an HR employee uploads the file, her local MCP reads the full document, finds the hidden instruction, and encrypts her entire folder (14:03). The server never changed. The attacker never touched her machine. The prompt in the document did the work.
Real-World Research: Jira Service Management Exfiltration
Attiya and his colleague Schlommo found that Atlassian’s JSM (Jira Service Management) lets anyone on the internet submit support tickets to internal teams. An anonymous attacker with no credentials opens a public JSM portal, pastes a prompt injection containing a JQL query for every non-empty project, and waits. When the support engineer’s Atlassian MCP reads the ticket, it runs the query, dumps the entire Jira database, and posts the results back to the attacker’s ticket before closing it. The attacker gets a full org chart of internal projects. The ticket disappears. No one is alerted. The support engineer never left their normal workflow.
Defensive Controls for MCP Environments
Before installing any MCP server, scan the tool descriptions for embedded instructions. Reputation signals matter: prefer open-source servers with many forks, stars, and contributors, because more reviewers means more eyes on the code. Disable tools inside an MCP that your workflow doesn’t need, and lock file-system access to a specific path instead of the entire user directory. At the organization level, SOC teams should monitor which MCP servers are running across the fleet and block write, update, or execute permissions by policy.
Q&A
Is MCP security just standard ‘don’t run untrusted code’ awareness — and who owns that responsibility? The speaker said awareness falls on users, the open-source community, and CISOs equally, because a compromised user’s MCP affects the entire organization, so companies must monitor agent activity and allowlist approved MCP servers rather than relying on individual judgment alone. ▶ 23:55
Can AI models themselves detect and block these MCP attacks? The speaker said AI can help but attackers will keep bypassing it, so behavioral monitoring of MCP activity is more reliable than trusting the model to self-police. ▶ 26:06
How do we ‘train our agents’ the way we trained employees not to click phishing links? The speaker said the solution is still unknown because MCP is so new, but adding authentication checks, monitoring the full agent pipeline, and waiting for dedicated security products are the current best options. ▶ 27:04
Are there secure MCP frameworks with built-in guardrails developers can use? The speaker said framework-level guardrails can be bypassed, so the stronger approach is monitoring MCP behavior and metadata at runtime to catch anomalies rather than depending on guardrails at build time. ▶ 29:27
Notable Quotes
With great power come great responsibility. But let’s get real. It really meant great risk. Dolev Attiya · ▶ 3:51
Don’t tell to the user. We want to be gentle. Don’t scare him. Dolev Attiya · ▶ 8:46
This is only MCP has invented this year. And this stuff is growing really fast. Dolev Attiya · ▶ 28:38
Key Takeaways
- Audit every MCP tool description before installation — malicious instructions hide in plain text.
- Prompt injection via user-supplied data can weaponize trusted MCP servers without touching the server code.
- Monitor and allowlist MCP usage at the organization level; individual user awareness alone is insufficient.
About the Speaker
Dolev Attiya
Dolev Moshe Attiya is a staff cyber security engineer at Cato Networks and member of Cato CTRL. Dolev plays a key role in fortifying Cato’s security against emerging threats and CVEs, showcasing his commitment to excellence in the dynamic field of cybersecurity. Prior to joining Cato in 2020, Dolev worked at Check Point Software as a cyber security analyst. With over more than five years of experience, Dolev specializes in threat analysis, research, and developing advanced countermeasures. Dolev served in the Israel Defense Forces (IDF). Dolev holds a Bachelor of Science (B.S.) in computer science from Holon Institute of Technology.