Security risks in MCP-enabled AI systems due to identity fragmentation
Kaspersky demonstrated in a controlled lab environment how rogue Model Context Protocol (MCP) servers could extract sensitive data such as passwords and cryptocurrency wallet files from AI system users, without active exploitation yet observed. The vulnerability creates potential supply chain attack risks as organisations rapidly adopt MCP-integrated AI tools.
What happened
Kaspersky researchers demonstrated in a controlled lab simulation how a rogue Model Context Protocol (MCP) server could be weaponised to extract sensitive data from users of AI systems.
In the simulation, unsuspecting developers using the AI coding assistant Cursor had their machines silently siphoned for browser passwords, credit card details, cryptocurrency wallet files, API tokens, and cloud configurations while seeing only expected outputs.
Kaspersky stated that no active exploitation has yet been observed, but warned that attackers could extend such abuse to install backdoors, deploy ransomware, or trigger malicious code execution through AI-integrated environments.
Reported impact
The openness of MCP's design, which allows large language models to access external tools and services, creates vulnerability to supply chain attacks that could lead to catastrophic data leaks.
Both Cursor and Anthropic have been notified of the findings.
Index analysis
MCP, an open-source integration standard developed by Anthropic in 2024, is designed to let large language models seamlessly access external tools and services such as code repositories, customer relationship management systems, cloud and financial data.
Kaspersky cautioned that while the proof-of-concept used Cursor, any LLM-based application could be similarly vulnerable to compromise through rogue MCP servers.
Governance controls
Kaspersky advised organisations to strictly vet MCP servers before use, run them in isolated environments, and monitor logs for anomalies.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.