Security risks of autonomous AI agents using MCP in enterprises
Researchers and security analysts have identified critical vulnerabilities in how enterprises deploy unmanaged MCP servers that give AI agents excessive privileges to internal systems. A newly disclosed browser flaw called ClawJacked could allow attackers to intercept and manipulate AI agent actions without user knowledge.
What happened
Unmanaged MCP servers deployed in enterprises give AI agents high-level privileges to access sensitive internal systems without adequate governance or monitoring.
Researchers at Pillar Security disclosed a browser vulnerability called ClawJacked that allows malicious websites to hijack MCP protocol handlers and silently intercept communications between AI assistants and their connected tools.
Reported impact
Indirect prompt injection attacks could trick AI agents into executing malicious code, such as uploading sensitive data from configuration files to external servers, while developers believe the agent is performing routine tasks.
Over-privileged MCP tool capabilities expose organizations to production failures if an agent misinterprets instructions, such as deleting branches or modifying critical data across an organization.
Index analysis
MCP servers are increasingly adopted across enterprise platforms including Claude, ChatGPT plugins, and enterprise copilots, alongside adoption by companies like Block, Apollo, and Replit.
The Model Context Protocol's design as a standardized interface to databases, APIs, file systems, and code repositories creates a broad attack surface if connections are not properly controlled.
Governance controls
Most organizations lack granular, tool-level access controls that would enforce the Principle of Least Privilege when connecting MCP servers to AI agents.
Enterprise MCP adoption is reported to be outpacing the implementation of security controls.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.