Analysis
MCP Security Statistics 2026: What the Vulnerability Data Reveals About AI Agent Risk
Publication date unknown · Discovered bonfy.ai
Page published
Publication date unknown · First observed: 17 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
MCP server weaknesses can expose agent-connected systems and credentials, making authentication, connector review, and tightly scoped tool permissions important defensive priorities.
Bonfy's MCP security overview compiles third-party audits reporting widespread server vulnerabilities and authentication weaknesses, including OAuth adoption of only 8.5% among more than 5,200 surveyed servers. The article also describes the Deadbugz supply-chain campaign, whose malicious MCP server reportedly behaves normally for three tool calls before changing its instructions to seek SSH keys and cloud credentials.