MCP's Broken Trust Model: Tool Poisoning, Rug Pulls, and the New Threat Landscape

Summary

Security guidance drawn from the NSA's May 2026 Model Context Protocol (MCP) security note warns that MCP's design can introduce new and poorly traced attack paths, because many implementations skip authentication, lack built-in RBAC exchange, and let previously approved agents reach sensitive resources later without renewed review. The guidance argues that runtime-scoped access, explicit trust boundaries, and rechecked authorization now matter more than endpoint patching alone.^[0]

The core problem is framed as a runtime trust problem rather than an integration problem: MCP can make access look authorised at connection time while the real security posture shifts during execution. Surveyed data underscores the governance gap — 80% of organisations report their AI agents have already acted beyond intended scope, 92% call governing AI agents critical while only 44% have any policy, and only 52% can audit the data their agents touch.^[0]

Complementary academic threat modeling of MCP using STRIDE and DREAD identifies tool poisoning — malicious instructions embedded in tool metadata — as the most prevalent and impactful client-side vulnerability, and finds that most of seven tested MCP clients defend poorly against it due to insufficient static validation and parameter visibility.^[8]

How it works

Tool poisoning embeds malicious instructions inside MCP tool metadata, so that when an MCP client presents or processes a tool description the injected instructions can influence the model's decisions — a prompt-injection style attack against the client side of the protocol. Threat modeling with STRIDE and DREAD across five MCP components (Host/Client, LLM, Server, External Data Stores, Authorization Server) identifies this as the most prevalent and impactful client-side vulnerability, worsened by insufficient static validation and limited parameter visibility in most clients.^[8]

At the protocol-governance level, MCP implementations frequently skip authentication, lack a built-in RBAC exchange, and permit agents approved at connection time to later reach sensitive resources without re-review, making access appear authorised while the actual security posture changes during execution.^[0]

Affected versions and patch status

Key takeaways

• MCP introduces a runtime trust problem: access approved at connection time can silently expand during execution, so identity governance must follow the session, tool, and decision path — not just the initial enrolment.^[0]
• There is a wide governance gap between recognition and action — most organisations report agents acting beyond scope and consider governance critical, yet fewer than half have implemented policies or can audit agent data access.^[0]
• Tool poisoning via malicious tool metadata is the leading client-side MCP risk, and most major MCP clients defend poorly against it, so client-side static validation and behavioral defenses are needed alongside server-side hardening.^[8]

Defensive actions

• Define explicit trust boundaries for every MCP deployment, separating agents, plugins, models, and human users into distinct trust zones and requiring authorisation at each boundary where data or action scope can expand.: MCP acts as a live trust boundary that can expand or contract during execution, so boundaries and authorization must be enforced wherever scope grows rather than only at enrolment.^[0]
• Enforce runtime authorisation for tool discovery, blocking implicit access to newly discovered tools unless the request is re-approved at execution time and tied to the specific agent process and task context.: MCP can make access look authorised at connection time while the real posture changes at runtime, and approved agents can otherwise reach sensitive resources later without review.^[0]
• Scope each MCP agent process to the minimum necessary privileges — the narrowest repository, data, and action set for the current task — and remove access paths the agent does not require.: Least-privilege scoping prevents a benign integration from quietly becoming a broad execution channel and limits the blast radius of over-scoped agents.^[0]
• Treat each connected agent as a non-human identity with an owner, scope, and review cycle, using continuous authorisation, strict trust zoning, and detailed transaction logging for every agent interaction.: Only 52% of companies can audit the data their agents access, so per-agent identity governance and logging close the investigation and compliance blind spot.^[0]
• Validate tool metadata with static analysis and add model decision-path tracking, behavioral anomaly detection, and user transparency mechanisms in MCP clients.: Tool poisoning exploits insufficient static validation and parameter visibility in clients; layered client-side defenses address the most impactful client-side vulnerability.^[8]