Model Context Protocol (MCP) servers are creating a silent enterprise governance gap which threatens to undermine cybersecurity efforts as AI deployments proliferate, according to new research from Ox Security.
MCP connects AI applications to external tools and data in a standardized manner, so that developers don’t have to write custom code each time they want to connect AI to an API or database.
However, in so doing, it might also be exposing organizations to cloud security risks that data residency requirements, zero trust boundaries, granular IAM policies and continuous supply-chain audits are meant to mitigate, Ox Security claimed in a new report.
That report, 15,465 MCP Servers, 0 Governance, has been produced from analysis across three public registries: mcp-official-registry, cline-marketplace and github-mcp-registry.
Read more on MCP risks: Prompt Injection Bugs Found in Official Anthropic Git MCP Server
The report found that nearly 16% of the 5095 unique hostnames it analyzed resolved outside the US, in countries including Russia and China.
“MCP has no protocol-level concept of geographic region,” it warned. “An enterprise can enforce strict residency controls on its own cloud workloads while its AI agents connect freely to servers sitting outside those same controls.”
Over 2% of the hostnames no longer even resolve, with some currently unregistered and available to buy, meaning a threat actor could impersonate the servers they used to point to, the report continued.
The Ox Security team also flagged that when they tested Claude Code with Haiku 3.5 and granted a single “always-allow” permission, it enabled subsequent malicious activity without requiring human approval.
“A malicious MCP server first asked for access to a harmless file. The user approved it with an always-allow permission,” it explained.
“The server then requested a sensitive file, .env among them, and got it, with no further prompt required. Anthropic’s response, in short: once always-allow is granted, that’s the documented behavior, and model-level detection of malicious content is a best-effort heuristic, not a security boundary.”
MCP Risk Proliferates
A Backslash Security report from June 2025 based on analysis of 7000 MCP servers found hundreds exposed to anyone on the same local network via a vulnerability dubbed “NeighborJack.” Around 70 had severe flaws, including unchecked input handling and excessive permissions.
In April 2026, Ox Security released another report, this time highlighting what it claimed is a “critical, systemic” vulnerability in MCP which could enable arbitrary command execution on any vulnerable system.
The vendor claimed that as many as 200 open source projects, 150 million downloads, 7000+ publicly accessible servers and up to 200,000 vulnerable instances could be exposed by the vulnerability.
The report described it not as a traditional flaw but “an architectural design decision baked into Anthropic’s official MCP SDKs across every supported programming language.”
The model maker dismissed the report as “expected behavior,” leaving the AI supply chain to work on fixes to patch the individual open source projects which it impacts.