MCP Security Flaw Turns AI Prompt Injection Into Credential Theft

Quick Facts

• MCP reached 97 million monthly SDK downloads by March 2026, making it critical infrastructure for AI-connected systems.
• The June 2025 MCP spec explicitly banned token passthrough, but servers built before mid-2025 still practice it widely.
• In May 2025, researchers demonstrated a live exploit on GitHub’s MCP server that exposed private repository data through a single malicious issue.

The Model Context Protocol has become the standard connector between AI agents and the tools they use. Now it is also becoming a standard attack surface.

Security researchers have traced a direct path from a planted prompt in an email or web page to a stolen OAuth token. The mechanism is indirect prompt injection, and MCP’s architecture makes it worse than most teams realize.

How the Attack Works

An AI agent calls a tool hosted on an MCP server. That tool fetches data from an external source, such as a Slack message, a GitHub issue, or a web page. The external content carries a crafted instruction: expose the current access token. Because the agent treats the tool result as trusted context, it complies. The token surfaces in the output where an attacker can retrieve it.

From there, the stolen credential works against any system that accepted the token. Attackers can move laterally, persist inside the target environment, or exfiltrate data with no further interaction required.

The Token Passthrough Problem

The specific flaw enabling this attack is called token passthrough. An MCP server takes the access token a client presents and forwards it directly to a downstream API without validating that the token was issued for that server. This breaks the audience guarantee of OAuth and gives a stolen token reach far beyond its intended scope.

The June 2025 MCP specification explicitly prohibited token passthrough and classified MCP servers as OAuth Resource Servers. It also mandated Resource Indicators under RFC 8707 to block token mis-redemption attacks. The spec was right. The problem is the code still running in production.

Most servers were built before the spec matured. Many developers did not read the security guidance closely. The prohibition exists on paper. The vulnerability exists in deployment.

Confused Deputy, Real Consequences

Security researchers at Obsidian Security disclosed a related class of vulnerabilities in late 2025. Several remote MCP servers from well-known organizations used a single static OAuth client ID when talking to upstream SaaS authorization servers. Once any user consented for that shared client ID, the upstream auth server cached the decision for all future requests.

An attacker could then send a crafted authorization link to a victim. The upstream server skipped the consent prompt entirely because it recognized the client ID. The victim handed over account access without knowing it. Vendors were notified in July and August 2025 and shipped fixes in late September.

The GitHub Demonstration

In May 2025, researchers showed the full attack chain using GitHub’s MCP server. They created a malicious issue in a public repository. The issue contained instructions directing an AI agent to collect and publish information about the repository owner. Because the MCP server held access to both public and private repositories, the agent followed the instructions and included sensitive private data in a generated pull request.

The trigger was a routine user action: asking the agent to review open issues. That single step was enough to initiate data exfiltration.

What Needs to Change

The MCP specification has moved quickly. Anthropic introduced OAuth 2.1 in March 2025. The June update fixed a widely criticized coupling between MCP servers and authorization servers. The November 2025 release added enterprise controls including centralized identity provider support and machine-to-machine authentication for autonomous agents.

Spec updates do not patch deployed servers. Teams running MCP-connected agents should audit every server for token passthrough behavior, verify OAuth audience validation is enforced, and treat all external content returned by tools as untrusted input. The attack chain from planted prompt to stolen credential is not theoretical. It has already been demonstrated in production environments.

MCP now connects AI agents to file systems, databases, code repositories, and SaaS platforms across thousands of organizations. The security assumptions baked into early implementations did not anticipate that scale.

Read more: MCP’s new spec turns a planted prompt into a stolen credential