Notifications
Clear all
Topic starter
19/08/2026 3:26 pm
TL;DR: A review of 281 MCP configurations finds that 72% expose high-privilege actions and 13% accept attacker-controlled inputs, creating compositional attack paths where a single crafted message can trigger silent code execution, according to Pynt. Traditional API security assumptions fail once MCPs become the execution layer for agents.
NHIMG editorial — based on content published by Pynt: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- Pynt reports that 72% of MCPs expose sensitive operations such as writing to disk, executing code, or calling high-permission APIs.
- Pynt found that 13% of MCP plugins accept attacker-controlled inputs from sources such as web scraping, Slack, or email.
- Installing 10 MCP plugins pushes exploitation risk to 92%, according to Pynt’s analysis of compositional risk.
Questions worth separating out
Q: How should security teams govern MCP tool access in enterprise environments?
A: Security teams should bind MCP tool access to enterprise identities, entitlements, and lifecycle state before a request reaches production tools.
Q: Why do MCP-based agents create more risk than ordinary API integrations?
A: Because the agent is choosing actions, chaining tools, and preserving context across steps.
Q: What breaks when AI agents can call tools after reading untrusted content?
A: The system stops being a text processor and becomes an execution surface.
Practitioner guidance
- Map every MCP chain to a privilege boundary Inventory how untrusted inputs flow into tools that can write files, execute code, or call high-permission APIs.
- Require approval for sensitive server calls Use the MCP host approval feature, or an equivalent policy gate, before any tool call that can change state or expand access.
- Restrict active MCP servers to the minimum set Disable every server and tool that is not actively required for the workflow.
What's in the full report
Pynt's full research report covers the operational detail this post intentionally leaves for the source:
- A complete dataset behind the 281 MCP configurations and how the sample was analysed
- Exploit chain diagrams showing how untrusted inputs reached privileged actions in live cases
- Platform-specific risk breakdowns for different MCP deployment patterns
- Methodology details on how compositional risk and silent exploitability were measured
👉 Read Pynt's full analysis of compositional risk across 281 MCP configurations →
MCP compositional risk: are your agent controls keeping up?
Explore further
19/08/2026 4:10 pm
Compositional risk is the new control gap in agentic systems. The article shows that individual MCPs can appear low risk while the chain as a whole becomes exploitable. That means assessment must move from connector-level review to workflow-level authorisation analysis. In identity terms, the trust boundary is no longer the plugin alone but the sequence of delegated actions it can assemble. Practitioners should treat composition itself as a governable security object.
A question worth separating out:
Q: How do security teams know whether MCP server governance is working?
A: They should be able to answer four questions at any time: what servers exist, which are official, what credentials they can use, and what systems they contact. If those answers are unclear, governance is not working. The signal is not just fewer alerts, but clear attribution and scoped access across the fleet.
👉 Read our full editorial: MCP compositional risk is creating silent AI execution paths
