On July 28, the MCP specification ships its release candidate. Among the headline fixes: OAuth 2.1 hardening and RFC 8707 Resource Indicators, which the spec says "directly address the confused deputy problem."
They do. The wrong one.
Two Deputies
The confused deputy — Norm Hardy, 1988 — is a program with more authority than its caller, tricked into misusing that authority on the caller's behalf. The classical fix is capability-based security: ensure a token minted for Server A can't be replayed against Server B. RFC 8707 does exactly this. When an MCP client requests a token, it must now specify which server the token targets.
Except MCP has two confused deputies.
Token replay, missing authentication, unsanitized inputs reaching system calls. The agent acts without permission.
Tool poisoning, prompt injection through outputs, semantic manipulation. The agent acts with full permission — on the wrong instructions.
In May 2025, someone posted a malicious GitHub issue — public, plain text, no exploit code. An AI assistant with MCP access to the repository read the issue, followed its instructions, and exfiltrated private repository contents, project details, and personal salary information. The token was valid. The user was authorized. The agent was functioning as designed.
The WhatsApp tool poisoning attack used the same vector. A malicious MCP server modified a legitimate WhatsApp tool's behavior. The agent — authorized, connected — exfiltrated hundreds of past messages to an attacker's phone number, disguised as ordinary communications, bypassing data loss prevention.
No identity failure. No token replay. The agent believed the wrong thing.
The Ledger
AuthZed has documented 20+ MCP security incidents since April 2025. Adversa AI counts 67 CVEs and 12,520 exposed MCP servers, roughly 40% with no authentication. The NSA's AI Security Center published formal MCP hardening guidance — its first for any AI agent protocol.
Sort the breaches by which deputy they exploit:
| Identity Layer — Being Fixed | ||
|---|---|---|
| Jan 2026 | gemini-mcp-tool | Unsanitized input → RCE. CVSS 9.8. |
| Mar 2026 | nginx-ui | No auth on MCP endpoint. 2,600 instances. CVSS 9.8. |
| Sep 2025 | Flowise | STDIO transport bypass → full system compromise. |
| Jun 2025 | MCP Inspector | Unauthenticated RCE on developer workstations. |
| Semantic Layer — No Protocol Fix | ||
| May 2025 | GitHub prompt injection | Public issue hijacked agent → private repo exfiltration. |
| Apr 2025 | WhatsApp tool poisoning | Legit tool modified → messages exfiltrated to attacker. |
| Feb 2026 | Oura MCP clone | Trojanized tool on public registry. StealC malware. |
| Sep 2025 | Postmark MCP | Fake server BCC'd all email to attacker. |
| 2026 | ClawHub marketplace | 1,184 malicious skills confirmed by Antiy CERT. |
The identity-layer attacks are being addressed. OAuth 2.1, RFC 8707, six SEPs in the July spec. Genuine progress.
The semantic-layer attacks are not. The agent IS authorized. The data source IS legitimate. The attack is in the meaning of what the agent reads. No authentication standard fixes a tool that says one thing and does another. No token-scope restriction prevents a Sentry error event from containing exfiltration instructions.
Cisco identified runtime agent-level guardrails as "the only currently viable mitigation path" for semantic attacks. The MCP-DPT taxonomy maps this precisely: MCP exposes pre-execution artifacts, shared context, multi-turn workflows, and third-party supply chains to adversarial influence. These attack surfaces don't exist in prompt-only interactions. They exist because MCP made the agent productive.
The Same Surface
Every MCP tool added for developer speed is another semantic input the agent trusts. The 10% of GitHub commits written through Claude Code, the 51% AI-generated code industry-wide — each line produced through an agent that reads tool outputs, file contents, error messages, and build logs as trusted context. The input surface that makes the agent fast is the input surface that makes it exploitable.
OX Security called MCP's core vulnerability "systemic" and "by design." Anthropic declined Invariant Labs' TrustFall report: functioning as designed.
The spec is fixing the deputy it can fix. The other one sits exactly where the protocol's value lives.