Ars Technica is raising alarms about the Model Context Protocol, known as MCP, describing it as a potentially dangerous standard for agent-to-agent communication that has so far escaped the scrutiny its risk profile arguably demands. The publication's framing — that this may be the riskiest protocol most people have never heard of — signals a concern not just about a technical flaw but about the gap between how fast the technology is spreading and how slowly the broader conversation about its dangers is catching up.
To understand why that framing lands with weight, it helps to understand what MCP is and where it sits in the current AI landscape. The protocol is designed to let AI agents communicate with one another and with external tools and data sources in a standardized way. Think of it as a kind of universal adapter layer: rather than every AI application building its own bespoke connections to every service it needs to reach, MCP offers a common language. Anthropic, the AI safety company behind the Claude family of models, introduced the protocol and has been actively promoting its adoption. The idea has intuitive appeal. Interoperability is generally good for ecosystems, and a world where AI agents can coordinate fluidly opens up possibilities for complex, automated workflows that a single model acting alone could not accomplish.
The problem, and it is a significant one, is that the same properties that make MCP useful also make it a serious attack surface. When you create a protocol that allows one AI agent to instruct another, to pass it context, tools, and commands, you are also creating a channel through which malicious instructions can travel. The AI security community has spent the past year or so documenting a class of attack called prompt injection, in which an adversary embeds hidden instructions in content that an AI system will eventually read, causing it to take actions its operator never intended. MCP, by design, dramatically extends the reach and consequence of such attacks. An instruction injected into one agent can now propagate to others, potentially cascading through a pipeline of automated systems before any human has a chance to notice something has gone wrong.
This sits inside a larger pattern that has defined the current period of AI deployment: capability races consistently outrunning safety infrastructure. The industry has repeatedly shipped powerful mechanisms for AI systems to take real-world actions — browsing the web, executing code, managing files, calling APIs — before the defensive tooling and the institutional norms needed to govern those mechanisms were in place. MCP looks likely to repeat that pattern at a higher level of abstraction. The protocol is not being built into a few experimental research systems; it is being designed as foundational infrastructure, which means its vulnerabilities, if left unaddressed, become foundational vulnerabilities.
The consequences here are not evenly distributed. For enterprise buyers moving quickly to build agentic workflows on top of AI platforms, the risk is that they are assembling pipelines whose full attack surface they do not yet understand. A sophisticated adversary who can inject instructions at the right point in an MCP-connected chain could, in principle, cause downstream agents to exfiltrate data, manipulate outputs, or take destructive actions while appearing to operate normally. For developers building on top of MCP, the likely reading is that the protocol's convenience creates pressure to adopt it before robust authentication, authorization, and sandboxing standards have been established around it. And for Anthropic, which has staked a significant part of its public identity on the idea that safety and capability can be advanced together, the protocol's security profile is a reputational as well as a technical challenge.
It would be unfair to suggest that no one inside the AI industry is paying attention to these risks. Security researchers have been writing about agentic attack surfaces with increasing urgency, and some of the concern is filtering into product decisions at major labs. But the history of internet protocols offers a cautionary note. Many of the most consequential security problems in computing today trace back to design decisions made in an era when the protocols in question were small enough that their creators could not fully anticipate the threat environment they would eventually inhabit. MCP is being built in a period when the threat environment is already well understood, which makes the argument for getting the security architecture right from the beginning considerably stronger.
What to watch for next is whether the protocol's governance structure produces meaningful security standards before adoption reaches the point where changing course becomes expensive. Specific areas worth tracking include whether third-party security audits of MCP implementations become standard practice, whether authentication mechanisms between agents are strengthened, and whether any high-profile incident involving an MCP-connected system brings the issue the kind of public attention that tends to accelerate institutional responses. The window for proactive action, as Ars Technica's coverage implicitly argues, is open but not indefinitely so.
