Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-05 · source-backed
The guidance walks through MCP's inverted client-server pattern, unverified task propagation between servers, and arbitrary-code-execution exposure (Adversa AI). The single highest-impact line: put authentication in front of every remote MCP server and pull unauthenticated ones off the public internet. When the NSA writes baseline guidance for your protocol, the protocol is critical infrastructure now. Treat it that way.
Each link below shares sources, entities, or timing with this story.
The NSA released authoritative MCP security guidance this month, walking through the protocol's inverted client-server pattern, unverified task propagation between chained servers, and arbitrary-code-execution exposure (Adversa AI). When the NSA ships design guidance for your...
BlueRock scanned over 7,000 MCP servers against 22-plus security rules. 36.7% carry potential server-side request forgery exposure from unrestricted outbound fetch, and 42% handle credentials insecurely. Their worked example is Microsoft's 85K-star Markitdown MCP server and it...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
The agent skills threat isn't isolated. The infrastructure layer is equally compromised. The Cloud Security Alliance's March 13 State of Cloud and AI Security report analyzed over 7,000 MCP servers and found 36.7% potentially vulnerable to server-side request forgery (SSRF). I...
Adversa AI's roundup shows Golf Scanner (20 checks across 7 IDEs), Astrix MCP Secret Wrapper (runtime vault integration), and mcp-sec-audit all shipped in April. PipeLab's "State of MCP Security 2026" is the first incident-by-incident mapping against the OWASP MCP Top 10. The...
At Vercel Ship 26 in London today, Guillermo Rauch launched what he's calling the Agent Stack: AI SDK, AI Gateway, Sandbox, Workflow SDK, and Chat SDK, plus a new Vercel Connect and a set of enterprise agent controls. Vercel is repositioning the entire platform around running...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.