Nearly Half of MCP Servers Flagged for Security Risks in 2026
Security firm Island scanned 33,563 MCP server builds and found security concerns in 49% of them. If you connect AI tools like Claude or ChatGPT to MCP servers, here is what the report actually means for you, in plain English.
📰 What Happened: Island Scanned 33,563 MCP Servers
Enterprise browser company Island published research examining the security of Model Context Protocol (MCP) servers, the connectors that let AI assistants like Claude and ChatGPT plug into outside tools such as your email, files, calendars, and databases. The team scanned 33,563 MCP server builds covering 475,865 individual tools. After filtering out harmless informational noise, 49% of server builds produced at least one non-informational security finding. In other words, nearly half of the connectors people are installing to give their AI assistants superpowers raised at least one flag worth looking at.
Two numbers stand out from the report. First, 7.8% of builds matched at least one rule associated with code or command execution, including shell or subprocess calls, unsafe deserialization, reverse-shell patterns, and execution paths reachable from tool input. Second, 6.6% of builds were configured to listen on 0.0.0.0 or a variable that could resolve to a non-loopback address, which can expose the service on every network interface instead of keeping it private to your machine.
Island's central argument is that MCP creates what it calls a second software supply chain risk. Traditional software can only be attacked through executable code. AI agents can also be steered by plain-English instructions hidden inside tool descriptions, prompts, and outputs, which means a malicious MCP server does not even need to run code to cause harm. The findings were reported by IT Brief Asia, and Island published the full study on its own blog.
🔌 MCP in Plain English: The USB Port for AI
If you are not a developer, MCP is easy to understand with one analogy: it is a USB port for AI assistants. Anthropic released the Model Context Protocol as an open standard in late 2024, and it has since been adopted across the industry, including by OpenAI and Google. An MCP server is a small program that gives an AI model a set of tools, such as read my Notion pages, search my Gmail, or query my database.
The convenience is real. Instead of copying and pasting between apps, you connect a server once and your assistant can act across your tools. Claude Desktop, Claude Code, ChatGPT connectors, and many agent products all use MCP or MCP-style connectors under the hood.
The catch is that anyone can publish an MCP server. There are thousands of community-built servers on GitHub and in various directories, and most users install them based on a README and a star count. Island's study is essentially the first large health inspection of that ecosystem, and the inspection came back with concerns in nearly half of the kitchens.
Why plain-English attacks are the new twist
A poisoned MCP server can carry hidden instructions inside its tool descriptions, such as text telling the model to quietly forward data somewhere else. Your AI assistant reads those descriptions as trusted context. This technique, often called prompt injection or tool poisoning, requires no hacking skills to attempt, which is exactly why Island calls it a second supply chain.
⚠️ Why It Matters for Solopreneurs and Everyday AI Users
You might think this is an enterprise problem. It is arguably a bigger deal for solo operators. A large company has a security team that vets software before anyone installs it. A solopreneur connecting Claude Desktop to a community MCP server for invoicing, email, or spreadsheets is acting as their own security team, usually without knowing it.
The risk is concrete because of what these connectors touch. People wire MCP servers into their Gmail, client databases, cloud storage, and payment tools. A server with a code-execution flaw or a hidden instruction does not just crash an app. It can potentially read the same data you gave your assistant access to, which often includes client information you are legally obliged to protect.
The honest framing matters too: a finding is not proof of malice. Many flagged servers are simply written carelessly by hobbyists, with risky defaults like listening on all network interfaces. But from your point of view the difference is small. Whether a door was left open on purpose or by accident, it is still open, and your business data is behind it.
📊 The Key Findings at a Glance
Numbers from security reports are easy to misread, so here is a table that translates each headline figure into what it means for a non-technical user. The percentages come directly from Island's published research as covered by IT Brief Asia.
One clarification worth repeating: 49% with at least one finding does not mean 49% of servers are malicious. It means nearly half showed at least one pattern that a security reviewer would want to check before trusting the server with real data. The smaller percentages, on execution paths and network exposure, are the ones that map most directly to real-world harm.
| Finding | Share of builds | What it means for you |
|---|---|---|
| At least one non-informational security finding | 49% | Nearly half of scanned servers raised a flag worth reviewing before install |
| Code or command execution patterns | 7.8% | The server could run commands, and in some cases attacker input can reach that path |
| Listening on 0.0.0.0 or similar | 6.6% | The connector may be reachable from your whole network, not just your own machine |
| Total scope of the study | 33,563 builds, 475,865 tools | This is a broad scan of the ecosystem, not a handful of cherry-picked bad servers |
✅ How to Protect Yourself Today: A 5-Step Checklist
You do not need to uninstall everything or stop using AI connectors. You need a habit of minimal trust, the same instinct you already apply to browser extensions and phone apps. Before your next install, run through the checklist below. It takes five minutes and removes most of the easy attack paths.
For sourcing, prefer official servers published by the company that owns the service, for example a Notion server from Notion or a GitHub server from GitHub, over anonymous community clones. Anthropic maintains a reference repository of MCP servers on GitHub, and Claude's own connector directory lists reviewed options, which beats installing the first result from a random search.
If you want to go deeper, read the primary sources: the IT Brief Asia article at itbrief.com.au and Island's full write-up on island.io. Both are readable without a security background.
- ✔Prefer official or well-known MCP servers over anonymous community builds
- ✔Grant the minimum access possible, connect one folder, not your whole drive
- ✔Keep human approval turned on for actions that send, delete, or pay
- ✔Audit your installed connectors quarterly and remove ones you no longer use
- ✔Never feed a connector credentials or client data it does not strictly need
🔭 The Bigger Picture: Agent Security Is 2026's Real AI Story
This report lands in the middle of a broader shift. In 2024 the AI conversation was about which model writes better, comparing releases like GPT-4o and the Claude models of that era. In 2026, with agent-capable models such as Claude Sonnet 4.6 and Claude Opus 4.8 doing real multi-step work, the conversation has moved to what these models are allowed to touch. Capability is no longer the bottleneck. Trust is.
Expect three things to follow from research like Island's. First, more scanning and vetting products, since a marketplace problem this size always attracts inspection tools. Second, pressure on registries and directories to verify publishers, similar to how mobile app stores evolved after their own wild-west phase. Third, better defaults from the AI vendors themselves, such as permission prompts, sandboxing, and clearer indicators of what a connector can access.
For readers of this blog, the takeaway is not fear, it is timing. People who learned basic app-permission hygiene early on phones avoided a decade of trouble. The same window is open right now for AI connectors, and the habits are just as simple.
❓ Frequently Asked Questions
What is an MCP server, in simple terms?
It is a small connector program that gives an AI assistant, such as Claude or ChatGPT, the ability to use an outside tool like your email, files, or a database. Think of it as a USB accessory for your AI: plug it in and the assistant gains a new capability. MCP, the Model Context Protocol, is the open standard that makes these connectors work across different AI products.
Does the Island report mean half of MCP servers are malicious?
No. The 49% figure means nearly half of the 33,563 scanned builds showed at least one non-informational security finding, which is a flag worth reviewing, not proof of bad intent. Many findings come from careless coding or risky default settings. The narrower figures, 7.8% with code-execution patterns and 6.6% exposed on all network interfaces, represent the more direct risks.
Should I stop using MCP connectors with Claude or ChatGPT?
For most people, no. The practical response is selective trust: use official or widely reviewed servers, grant minimal permissions, keep approval prompts on for sensitive actions, and remove connectors you no longer use. That removes most realistic attack paths while keeping the productivity benefits.
How do I check if an MCP server is safe before installing it?
Check who published it, prefer the company that owns the service or a well-established open-source project. Look at whether the code is public and actively maintained, and search the name plus the word vulnerability before installing. Then limit what it can reach: one folder instead of a whole drive, a read-only key instead of a full-access one. No check is perfect, but publisher reputation plus minimal permissions covers most of the risk.
🏁 Final Thoughts
The short version: Island scanned 33,563 MCP server builds and found security concerns in 49% of them, including code-execution patterns in 7.8% and network overexposure in 6.6%. That does not make MCP dangerous to use, but it does end the era of installing connectors on vibes alone. Treat AI connectors the way you treat phone apps: check the publisher, grant minimal access, keep approvals on, and prune what you do not use. Full details are in the IT Brief Asia article (itbrief.com.au) and Island's original research (island.io). If this explainer saved you a rabbit hole, subscribe to Agents at Work for a plain-English breakdown of AI news each week, and drop a comment with the connectors you actually rely on. I read every one.
Last updated: August 03, 2026 · Keyword: MCP server security · Agents at Work
Comments
Post a Comment