What is MCP, and why does it matter that 21,000 servers were exposed
AI assistants that can now do far more than generate text — reading emails, querying databases, or making changes in code repositories — owe much of that capability to an open standard called the Model Context Protocol, or MCP. New findings from security researchers, though, show that the protocol's rapid spread has brought serious risks along with it.
Put simply, MCP is a connection layer that lets an AI model communicate with outside 'tools' — a file system, an API, an internal company database — using a standard, universal language. Before the protocol existed, developers had to wire up each AI application to each tool individually; MCP collapsed that process down to a single shared interface, a major convenience.
That convenience drove extraordinarily fast adoption. Developers can spin up an MCP server within minutes, giving AI assistants access to everything from email inboxes to cloud storage accounts.
But researchers scanning the internet found more than 21,000 MCP servers publicly accessible without requiring any authentication. A significant portion of these servers provide direct access to file systems, internal APIs, or sensitive data.
The root of the problem lies in how many developers spin up MCP servers quickly, intending them only for local testing environments, only for those servers to end up exposed to the open internet by accident through misconfiguration or default cloud infrastructure settings.
In a scenario where an attacker gains access to an exposed MCP server, they can, in theory, inherit whatever permissions the AI tool connected to that server has. That can range from simple file-reading access to the ability to run commands inside a company's internal systems.
Security specialists describe this less as a design flaw in MCP itself and more as a mismatch between the speed of adoption and the pace at which security best practices have caught up. The protocol itself supports authentication and authorization mechanisms; the problem is that they often simply aren't turned on.
Specialists recommend a few basic precautions for developers setting up an MCP server: never expose a server to a public network without authentication, restrict access to only the tools that are strictly necessary, and run regular security audits.
Organizations that develop and support the protocol, including Anthropic, say they have updated security guidance and are working to inform developers about hardening default configurations. As the ecosystem matures, similar security checks are expected to become standard practice.
Specialists say these kinds of 'growing pains' are common for new technology standards, but stress that given the broad permissions MCP grants to AI assistants, closing these security gaps is more urgent this time than usual.
Read next
Judge gives Google one week to fix 'anticompetitive' download flow in Google Play
A federal judge has ruled that Google made it unnecessarily difficult for Android users to download alternative app stores, giving the company one week to fix the flow. The order will make third-party app stores more visible and accessible from within Google Play itself.
The world's largest all-electric aircraft flew its first test using just $5 of electricity
A venture backed by commercial airlines has completed the first test flight of what it calls the largest all-electric aircraft to fly, using roughly $5 worth of electricity for the flight. The company's longer-term goal is to develop a hybrid-electric, and eventually fully electric, commercial passenger aircraft.
How to tell if your AI platform account has been hacked
AI accounts on platforms like ChatGPT, Claude and Gemini are becoming an increasingly attractive target for hackers, given the personal conversation histories and linked payment details many of them hold. Here's how to check whether your account has been compromised and what to do about it.
Every fusion energy startup that has raised over $100 million
Fusion energy startups have collectively raised $7.1 billion to date, with the majority of that money concentrated in a handful of companies. Here's a look at the best-funded fusion startups and how their technical approaches differ.
You can now turn off Google Gemini's visible AI watermarks. Here is what that actually changes
Google now lets users toggle off the visible watermark that normally appears on images, videos and music generated with Gemini and its Nano Banana and Omni models. The invisible SynthID watermark and embedded metadata remain in place regardless, meaning the content stays technically traceable as AI-generated even when it no longer looks that way.