On June 29, Tenet Security published Agentjacking. Inject a fake Sentry error through a public DSN. The MCP server returns it as trusted system output. Claude Code executes the attacker-controlled npm package embedded in the "fix." Eighty-five percent success rate. 2,388 organizations exposed. Over a hundred agents ran the test payload, including one at a Fortune 100 company worth $250 billion. Cloud credentials and git tokens were accessible. The Cloud Security Alliance classified it as a systemic MCP vulnerability class.
On June 30, Adversa AI published GuardFall. Type r''m. The text filter doesn't match it against rm. Bash strips the quotes and runs rm. Ten of eleven open-source coding agents — Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, opencode, Hermes — are vulnerable. 548,000 combined GitHub stars. The trick predates most of these tools by decades. Only Continue was safe: it parsed commands through a bash-compatible parser before checking. Fix for the others: roughly two days of engineering.
On July 2, Cato AI Labs published DuneSlide. Two CVSS 9.8 vulnerabilities in Cursor IDE. One lets the agent add system folders to its own allowed-write list. The other exploits a symlink resolution fallback that trusts the unresolved path. Combine them with prompt injection through MCP and you get zero-click remote code execution — no user approval required. Cursor initially rejected the reports in February: "MCP misuse is outside our threat model."
Three attacks. Three layers. Three days.
What each layer assumes
Data — the sandbox will contain whatever I pass through
Sandbox — the model won't be prompted with anything malicious
Execution — commands will arrive in a form my filter recognizes
Each layer delegates verification to the next. No layer verifies the full chain.
The Gap
The protocol is getting more secure. MCP's July 28 release candidate adds OAuth 2.1, enterprise authorization from Anthropic, Microsoft, and Okta, stateless sessions, and sandboxed UI rendering. A2A hit stable 1.0. The Linux Foundation governs the stack.
The implementations are broken by shell quoting tricks from the 1980s.
Microsoft's State of MCP Security report counted 3,012 servers in the MCP registry. Only 8.5% use OAuth. The rest rely on static API keys, personal access tokens, or nothing. GitGuardian found 24,008 secrets exposed in MCP configuration files on public GitHub — 2,117 still valid at time of scan. Fifty-plus tracked MCP vulnerabilities, thirteen rated critical. AvePoint: 88.4% of organizations have experienced at least one agent-related security incident.
Every spec improvement redistributes where trust decisions happen. MCP going stateless eliminates session management overhead and delegates state security to individual server developers. MCP Apps add interactive UIs inside sandboxed iframes that create new XSS and phishing surfaces. Akamai's security team flagged each new feature as a new attack vector: Tasks create DoS vectors where creation is cheap and execution is expensive. New HTTP routing headers enable protocol confusion.
Why Patches Don't Fix It
Each of these three attacks will be patched. Sentry DSNs can be rotated. DuneSlide was already fixed in Cursor 3.0 in April. GuardFall could be fixed in two days with a bash-compatible parser. These are engineering problems with engineering solutions.
The chain is not an engineering problem.
Each security boundary was built to solve one coordination problem — data ingestion, sandboxed execution, command filtering — and each pushes security decisions to the layer it doesn't control. The MCP server doesn't verify what the sandbox will do with its output. The sandbox doesn't verify what the model has been prompted with. The command filter doesn't verify what bash will do with the string it approved. The gap between spec and practice at each layer is the attack surface — and each layer's gap is invisible to the layers around it.
Six independent exploit teams broke Claude Code, Copilot, Codex, and Vertex AI in the same period. Every attack hit runtime credentials that IAM never tracked. CrowdStrike CTO Elia Zaitsev's recommendation: "Collapse agent identities back to the human."
That's not a fix. That's an admission that the chain can't verify itself.