The findings come from researchers at an unnamed firm who analyzed MCP integrations across customer and prospect environments over the past several months. They discovered that over 20 percent of MCP-related access policies they reviewed were non-functional or absent, leaving the door open for unauthorized access to internal systems.
This vulnerability is compounded by the findings of a 2026 benchmark called MCPTox. Tested against 45 live MCP servers and 20 models, it revealed an average attack success rate of 36.5 percent, rising to 72.8 percent against the worst-performing model. The benchmark measured how easily an AI agent could be tricked by malicious instructions hidden in tool descriptions — a vector demonstrated as early as May 2025 by researchers at Invariant Labs, who showed that GitHub's own MCP server could be hijacked through a poisoned public issue.
The systemic weakness is further illustrated by ecosystem-wide data. Across the MCP ecosystem, 88 percent of servers require credentials to function, but only 8.5 percent actually use OAuth. By some estimates, over half of MCP servers in the wild run on static API keys or personal access tokens that are rarely rotated, and close to half of enterprise AI activity runs through personal accounts rather than service accounts.
A concrete example of this problem surfaced with Splunk's own MCP Server app, which logged session and auth tokens in cleartext until patched in version 1.0.3 (tracked as CVE–2026-20205).
On July 28, 2026, the Model Context Protocol's maintainers shipped a specification update built almost entirely around authorization: issuer validation, issuer-bound client credentials, and Client ID Metadata Documents. The update is widely seen as an admission that the original trust model did not survive contact with production environments.
A common failure mode identified by the research is that scopes default to everything. Many servers that need only read-only calendar access request read, write, and admin permissions because that is what tutorials use. In practice, most MCP tools are never scoped in the first place, often reusing admin-level API keys originally created for other purposes years prior.