MCP’s trust gap lets one agent spread malicious instructions

What changed · following since Oct 6 Oct 7 — OX Security found no marketplace vetting across 15,465 public MCP servers, including expired domains and hosts routed through consumer tunnels.

MCP is exposing a structural trust boundary between connected agents: a compromised agent can pass harmful instructions to others and trigger data exfiltration. Over the past five months, Google and four other organizations have acknowledged vulnerabilities involving agents, while MCP servers can also consume substantial context before performing useful work. The public-server ecosystem adds a supply-chain risk because deployment channels may lack basic vetting and include unreliable infrastructure.

• AI-agent adoption across millions of organizations creates opportunities to exfiltrate database contents and sensitive business or personal information.
• Google and four other organizations acknowledged agent vulnerabilities over the five months preceding October 5, 2026.
• The described attack pattern uses one agent inside a targeted network to spread harmful instructions to another agent.
• One MCP server consumed 18,000 tokens before doing anything, exposing a separate operational cost in MCP-based agent workflows.
• OX Security found no marketplace vetting across 15,465 public MCP servers, including expired domains and hosts routed through consumer tunnels.

Bottom line If you connect agents through MCP, review trust boundaries, marketplace provenance, tool permissions, and context consumption before expanding the deployment.