All news with #mcp security tag

🛡️ This post explains how Check Point extends Google Cloud’s Gemini Enterprise control plane to secure production AI agents through discovery, risk assessment, and runtime protection. It outlines integration points—Agent Registry, Agent Gateway, and observability—and describes how Check Point enforces prompt defense, MCP security, and context-aware policy enforcement. Examples from Dropbox and Nubank illustrate low-latency, high-accuracy protection at scale.

🔎 In 2024, the MCP standard gained broad adoption as a connector for models, agents, and IDEs, but the surrounding marketplaces lack security controls. OX Security analyzed 15,465 publicly indexed MCP servers and found weak governance, servers hosted in risky jurisdictions, personal machines using consumer tunneling, and dangling domains that can be hijacked. The report warns enterprises to treat trust as an attack surface and to adopt vetting, code signing, and origin verification until marketplaces do.

🛰️ Since its August debut, Kitesurf — a browser built to serve AI agents and running on Cloudflare Workers — has gained WebMCP support, broader web standards compatibility, and major efficiency improvements. Developers can test WebMCP-enabled pages in the Kitesurf playground and use Kitesurf through Browser Run with CDP, Playwright, Puppeteer, or MCP. The team also added a terminal renderer and expanded Web Platform Tests coverage while keeping resource use near launch benchmarks.

🛡️ New research from Ox Security warns that Model Context Protocol (MCP) servers are creating an enterprise governance gap as AI adoption grows. MCP standardizes connections between AI models and external tools or data, but in doing so can bypass residency controls, zero trust boundaries and granular IAM policies. Analysis of public registries found many hosts outside the US and some unregistered, while permission models like “always-allow” enabled unauthorized data access in tested scenarios.

🛡️ A critical vulnerability in Bifrost, an open-source AI gateway, lets unauthenticated attackers execute arbitrary commands on the gateway server via a single HTTP request when management authentication is disabled. Tracked as CVE-2026-90898 (CVSS 9.8), the flaw affects HTTP transports before transports/v2.1.0 and is exploitable by registering a stdio-type MCP client through the management API; a fix is available in v2.1.0. Operators should upgrade, enable management auth, and rotate exposed keys if the management API was reachable.

🛡️ Check Point’s Workforce AI Security lets organizations control employee interactions with AI across apps, conversations, and agent activity. Through Manage Interactions, teams can define allowed AI applications, data handling for prompts and uploads, and govern the Model Context Protocol (MCP) servers and tools available to agents. The Workforce AI MCP enables natural-language access to policy information, investigation, and management, making complex analysis and changes more direct and efficient.

🔍 Security researchers warn major gaps in IT oversight and rising vulnerabilities are increasing risk across the AI agent ecosystem. Reco analyzed enterprise telemetry, MCP servers, and NVD disclosures in its report, The State of Agent Security 2026, finding 80% of AI tools lack governance and SMBs average 414 unsanctioned tools per 1,000 employees. The study found many MCP servers allow shell execution, file access and outbound network calls, with numerous tools exposed without authentication. Vulnerability disclosures have also surged, straining patch programs.

🛡️ Marimo fixed a high-severity code injection that let a crafted notebook supply a malicious Model Context Protocol (MCP) command executed as a local subprocess when opened in edit mode. Tracked as CVE-2026-75149 and scored ~8.7–8.8, the flaw affected versions prior to 0.23.15 and required user interaction but no attacker authentication. Marimo released version 0.23.15 and later versions to remediate the issue.

🔒 The Model Context Protocol (MCP) enables AI agents to access tools and data across enterprise systems, but the MCP server often stores credentials, tokens and keys that can expose an organization if mishandled. Common risks include plaintext config files, credential sprawl, prompt injection, over-permissioning and untrusted exposed servers. Mitigations include centralizing secrets, using short-lived credentials, enforcing least privilege, human approval for sensitive actions, end-to-end encryption, thorough logging and inventorying MCP servers.

🔒 Cloudflare announces new Cloudflare One capabilities to detect and control Model Context Protocol (MCP) traffic. These features let administrators identify which users and servers are generating MCP requests, distinguish Portal-mediated connections from direct ones, and block unauthorized direct connections on managed network paths. The update combines Gateway protocol signals with MCP Server Portals to help teams find shadow MCP servers and enforce Portal-only access to trusted MCP endpoints.

🔐 Security researchers say the real risk with AI agents lies less in the model and more in the surrounding harness — the code that turns model output into actions. Vulnerabilities in harness architecture, implementation choices, and the expanding supply chain of skills and plugins have enabled credential theft, code execution, and persistent malware. Experts urge CISOs to inventory harnesses, restrict their permissions, and independently test vendor claims to reduce exposure.

🛡️ A new technique called GhostSplice shows how a malicious Model Context Protocol (MCP) server connected to an AI coding assistant can exfiltrate SSH keys, environment secrets, source code, and customer data by splitting a theft into harmless-looking fragments. ASSET Research Group tested the approach in isolated projects using fake credentials and found that splitting the request across tool descriptions, results, or server-initiated sampling raised compliance dramatically for many models. The attack relies on developers connecting a hostile MCP server and the agent already having access to the target files.

🔒 AWS WAF now offers the Salt Security managed rule group, available via AWS Marketplace as Salt Managed Rules for AWS WAF - AI Agent & API Security. The group provides detection and mitigation for API-focused attacks and traffic from AI agents and Model Context Protocol (MCP) endpoints without requiring customers to write custom rules. It addresses threats such as credential brute force, excessive GraphQL queries, SSRF, prototype pollution, and JWT anomalies while labeling MCP traffic and sensitive request attributes. Customers can subscribe and add the rule group to a web ACL directly in the AWS WAF console; pricing and versioning are managed by Salt Security through AWS Marketplace.

🔎 Cloudflare outlines the rise of software agents as a new class of web visitors and presents the concept of an "Agentic Internet" built to be readable, discoverable, callable, and payable. The post describes open standards and tools—like Web Bot Auth, PACT, Markdown for Agents, WebMCP, and Monetization Gateway—that enable cooperation between agents and domain owners. Cloudflare positions itself as a neutral platform offering these primitives while advocating for an open, standards-based future.

🛠️ The MCP 2026-07-28 specification makes the Model Context Protocol fully stateless, removing session handshakes and Mcp-Session-Id requirements. The update simplifies deployment by allowing MCP servers to run on request-scoped infrastructure like Cloudflare Workers, while preserving elicitation via Multi Round-Trip Requests and tightening authorization with CIMD and RFC 9207 issuer checks. SDKs and migration guidance accompany the release.

🔧 Cloudflare is launching a developer preview of WebMCP, a browser standard that exposes a document.modelContext surface to enable AI agents to interact with sites without changing origin code. With a single toggle in the Cloudflare Dashboard, an edge injection adds a small bridge script that registers tool packs in the visitor's browser. Two packs—Content Credentials and Site MCP Server—run entirely client-side in this preview, while future packs may call edge workers for heavier tasks.

🛡️ Cloudflare describes WriteGuard, a centralized policy, attribution, and auditing layer for MCP servers now available in private beta. It sits between MCP clients and tool handlers to classify calls by risk, attach agent attribution, scrub audit events, and block dangerous actions before execution. The post explains how WriteGuard integrates with existing identity flows, per-tool configuration, and an asynchronous audit Worker to make agentic writes visible and controllable across MCP-connected systems.

🔒 A critical vulnerability in the open-source AI agent platform Ruflo (CVE-2026-59726, "RufRoot") allows unauthenticated attackers to exploit an exposed Model Context Protocol (MCP) bridge and gain full control of enterprise AI environments. Researchers at Noma Security showed a single HTTP request to the bridge’s /mcp endpoint can execute code, steal LLM API keys, access conversations, hijack agents, and poison persistent AI memory. Ruflo issued a rapid patch that binds the MCP bridge to loopback and enforces failure-closed behavior, while researchers urged immediate firewall and credential remediation.

🛡️ Researchers disclosed a critical vulnerability (CVE-2026-59726) in Ruflo, an open-source agent orchestration harness for Anthropic Claude Code and OpenAI Codex, that permitted unauthenticated remote code execution. The flaw, present in versions before 3.16.3, exposed an unauthenticated Model Context Protocol (MCP) bridge on port 3001 by default due to docker-compose binding to 0.0.0.0. Exploitation allowed attackers to run shell commands, steal LLM API keys, read conversations, poison AI memory, and persist backdoors. The maintainer released fixes after disclosure, changing the MCP binding to loopback, gating execution controls, and enabling MongoDB authentication.

🔍 Enterprises face rising attacks that exploit AI agents already present in their environments. These agents — coding assistants and CLI tools like Claude Code CLI, Gemini CLI, and Amazon Q CLI — can read files, run commands, and install packages, making them attractive targets when run with auto-approval. Real-world incidents, including the s1ngularity Nx npm compromise and the AgentJacking/Sentry experiments, show how prompt injection, compromised tool metadata, and unsecured MCP servers can lead to secret harvesting and covert exfiltration. Defenders must treat agents as potentially untrusted and adapt controls and monitoring accordingly.