Why MCP security is about permissions overhaul
The New Stack Mohit Bansal ● Covered by 2 sources
MCP blew up fast, but the real security problem is the access beneath it. Teams trusted defaults; attackers found overbroad credentials and weak boundaries.
Based on reporting by The New Stack, Mohit Bansal — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Model Context Protocol was supposed to make AI tools plug together cleanly. It went into production in late 2024, spread quickly, and then became the thing everyone seemed to be building around. Thousands of MCP servers followed. Microsoft, Google, and OpenAI backed it. The Linux Foundation now maintains it. At this point, MCP is being treated less like a side project and more like plumbing.
That also made the failures easier to spot. The uncomfortable lesson that emerged in 2026 was not that MCP itself was broken, but that the permissions under it were doing too much work. Security teams had mostly installed it the way they install any other integration standard: turn it on, trust the defaults, move on. That works right up until an agent inherits access it never needed.
The examples are already ugly. In May 2025, prompt injection against GitHub’s MCP server exposed private repository data because the personal access token behind it was scoped too broadly. Days later, an Asana MCP integration had a logic flaw that let access cross tenant boundaries. Researchers now talk about tool poisoning, where a server’s own tool description hides instructions, and the confused deputy problem, where the agent gets more trust than the job calls for.
The fix being pushed by security teams is not another scanner. It is narrower, more annoying, and a lot more honest: separate credentials for each instance, requests tied to the acting user, authorization based on the action instead of a one-time login, and temporary credentials instead of permanent ones. GitHub’s engineering guidance points in that direction, and Webflow says it treats MCP integrations like any other third-party component with access to customer data.
The deeper issue is identity. For most of the industry, an agent is still basically a human’s OAuth token in a trenchcoat. That is tolerable for tasks that last minutes or hours. It gets much less funny when agents live for weeks or months. OAuth was built for a person reading a scope dialog and making a choice, which already was a generous assumption; it falls apart when no human is really in the loop.
So MCP security is turning into a permissions overhaul, not a patch-and-pray exercise. The teams that will be ahead are the ones that stop treating scope, identity, and lifespan as separate checks and start treating them as one decision. That’s not flashy, but security rarely is when it’s doing its job.
My take — AI-written commentary, not fact-checked reporting
This is the usual AI industry mistake: ship the shiny thing first, then act surprised when identity and scope become somebody else’s problem. MCP isn’t the villain here; lazy permission design is. Anyone still handing agents broad standing access and calling it “integration” is just outsourcing the breach to later.
Read more about this at: The New Stack