All postsStart free
Emerging Tech6 min read

MCP Servers Are the New Attack Surface for AI Agents

MW

Marcus Webb

Principal Security Engineer · June 18, 2026

Illustration of an AI assistant connected to multiple MCP tool servers, one of them compromised

The Model Context Protocol (MCP) has become the default way to connect AI agents to external tools, files, and APIs. It is powerful and it is spreading fast, which is exactly why attackers are paying attention. A single malicious, spoofed, or over-permissioned MCP server can quietly exfiltrate data, inject instructions, or chain into actions the user never approved. For mobile teams shipping agentic features, every MCP connection is now part of your attack surface.

Why MCP changes the risk picture

MCP makes tools composable: an agent can discover a server, read its tool descriptions, and start calling it. That same flexibility means a poisoned tool description can carry hidden instructions, and a rogue server can impersonate a trusted one to harvest the data the agent sends it.

Because the agent acts with the user's authority, a compromised MCP connection does not just leak data, it can take actions, and on mobile those actions reach contacts, files, and payment flows.

Where MCP goes wrong in a mobile app

The failure modes are concrete and show up repeatedly when teams wire MCP into a client.

  • MCP server URLs and auth tokens hardcoded or stored insecurely on-device
  • Tool descriptions trusted blindly, allowing tool-poisoning prompt injection
  • Over-broad scopes that let one server reach data meant for another
  • No verification that a server is the legitimate one the user expects

How RASMISER secures your MCP connections

RASMISER traces where your app stores MCP credentials, how it validates servers, and which tool calls run without a confirmation gate, mapping each finding to OWASP MASVS so your team knows exactly what to fix.

With runtime protection, the endpoints your agent talks to stay pinned and tamper-resistant, so a spoofed MCP server cannot quietly slot itself into your toolchain.

The takeaway

MCP is becoming core infrastructure for AI agents, and untrusted tool servers are a first-class threat. Treat every MCP connection like untrusted input: verify the server, scope the permissions, and scan where the tokens live.

Scan your app free

Keep reading

Illustration of an AI model generating personalised phishing messages targeting employees on mobile devices
Cyber Threats

AI-Generated Phishing: Why Every Employee Is Now a High-Value Target

LLMs can now write flawless, hyper-personalised phishing messages at industrial scale. The generic mass-phish is dead — what replaced it is far harder to spot and your app is the delivery mechanism.

Illustration of an AI malware strand mutating its code to bypass antivirus detection layers
Cyber Threats

Autonomous AI Malware: The Threat That Rewrites Itself to Escape Detection

A new class of AI-driven malware can observe its environment, modify its own payload, and wait for the ideal conditions to strike. Static signatures are no longer enough, and your app binary is a target.