> ## Content Index
> Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# MCP Server Security: 15,465 Servers Expose AI Risk
- URL: https://www.cybrsecmedia.com/15-465-mcp-servers-expose-an-ai-agent-governance-gap/
- Published: 2026-09-25T13:07:49.000Z
- Updated: 2026-09-25T13:10:22.000Z
- Description: Research into 15,465 MCP servers exposes risks from foreign infrastructure, abandoned domains, standing permissions and weak AI governance.
- Author: Bill Brenner
- Tags: MCP server security, Agentic AI, AI Governance, Article

A decade of cloud security taught enterprises to ask some basic questions before trusting infrastructure with sensitive data: Where does it run? Who controls it? What data can it access? What code is actually running? And what happens when the infrastructure changes hands?

The rush to connect AI agents to the outside world through the Model Context Protocol (MCP) may be bypassing much of that hard-won discipline.

[Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free)

New research from OX Security analyzed 15,465 publicly listed MCP servers and found infrastructure scattered across foreign jurisdictions, consumer networks and abandoned domains that could potentially be acquired for the price of lunch. Researchers also demonstrated how a malicious MCP server could exploit a user's standing approval to access a sensitive file without asking permission again.

The findings don't suggest MCP itself is inherently insecure. They expose something potentially more consequential for enterprises racing to deploy agents: Organizations may be approving what an MCP tool does without establishing who controls the infrastructure behind it.

OX calls the result a new class of "shadow infrastructure." 15,465 MCP Servers, 0 Governance

**Download the full report:**

[15,465 MCP Servers. 0 Governance.Is your AI supply chain secure? Read OX Security’s analysis of 15,400+ public MCP servers covering prompt injection, data residency, and account takeover risks.![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/icon/cropped-fav-270x270-fb5cc87b-ede4-419f-a2d5-3e61386b8ed8.png)OX SecurityOX Security![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/thumbnail/How-MCP-Is-Bypassing-a-Decade-of-Cloud-Security-Best-Practices-1-1-69e42d66-1892-48aa-a62a-622a6530ba34.webp)](https://www.ox.security/ebooks/15465-mcp-servers-0-governance/?ref=cybrsecmedia.com)

## 15,465 MCP servers, 5,095 unique hostnames

OX began with 15,465 MCP servers published across the mcp-official-registry, cline-marketplace and github-mcp-registry. Researchers extracted 16,296 endpoints, reduced those to 7,791 unique URLs and ultimately analyzed 5,095 unique hostnames for infrastructure, geolocation and domain-registration characteristics. 15,465 MCP Servers, 0 Governance

The percentages in the report generally refer to those **5,095 unique hostnames**, not all 15,465 MCP listings. Of those hostnames, OX found:

- **15.6% — 796 hostnames — resolved outside the United States.** Nineteen were in China and 18 in Russia.
- **0.45% were associated with home networks or locally hosted systems using consumer tunneling services.**
- **2.3% no longer resolved through DNS.**
- **Six domains were unregistered and available for approximately $4 to $12 per year.** 15,465 MCP Servers, 0 Governance

The geographic finding needs some context: 

- An IP address resolving to China, Russia or another country does not establish that an MCP operator is located there or that enterprise data is being transferred there.
- OX explicitly describes its results as infrastructure and governance signals rather than a definitive map of server ownership or data residency.
- CDNs, proxies, VPNs and cloud infrastructure can complicate geolocation. 15,465 MCP Servers, 0 Governance

MCP has no protocol-level mechanism for specifying a geographic region or enforcing data-residency requirements. An enterprise can tightly restrict where its cloud workloads operate while an AI agent connects to an MCP server sitting outside those controls. 15,465 MCP Servers, 0 Governance

## The $4 MCP takeover problem

The abandoned domains may be the more immediately unsettling finding. OX found that 2.3% of the hostnames it examined no longer resolved. Six were not merely offline; the domains themselves were available for registration for roughly $4 to $12 annually. That creates a potential trust inheritance problem.

If an existing developer configuration, application or automated pipeline continues pointing toward one of those domains, someone could register it and place new infrastructure behind an endpoint that the client already trusts.

OX said an attacker could potentially imitate the original MCP server, expose malicious tools, collect information sent by clients or serve malicious content to connected AI agents. 15,465 MCP Servers, 0 Governance

In other words, the domain might cost $4\. The inherited trust attached to it could be worth considerably more.

**Related:**

[AI Agent Security: Detection and Response Fall BehindAs autonomous agents write code and manage infrastructure with scant oversight, the security frameworks built for predictable systems can’t keep pace.![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/icon/CYBR.SEC.Media-Logo-copy-dbc1f158-16c6-4229-a1df-1aeab73426ef.jpg)CYBR.SEC.MediaGeorge V. Hulme![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/thumbnail/c45feafe-3e2d-4455-ba40-182eca482c27-229ff2b4-c78f-4687-adb6-f8d6e5648fd4.png)](https://www.cybrsecmedia.com/gai-agents-have-changed-the-rules-of-the-game-detection-and-response-havent-caught-up-yet/)

[AI Security Risks: Cyber Experts Separate Threat From FUDAs AI leaders warn of catastrophic risk, cybersecurity experts separate credible threats from speculation and identify the guardrails needed now.![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/icon/CYBR.SEC.Media-Logo-copy-df4e9035-6077-4c8b-954c-b2ce9fe06b23.jpg)CYBR.SEC.MediaBill Brenner![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/thumbnail/AI-Core_-Alarm-and-Containment-9826e3df-3e47-423b-a420-351a82d7137a.png)](https://www.cybrsecmedia.com/ai-could-kill-us-all-cyber-experts-cut-through-the-fud/)

## You inspected the code. But is that the code running?

OX identified another hole in the MCP trust model: Reviewing an MCP project's source code doesn't necessarily tell an organization what's running on the live server.

The protocol doesn't require a published GitHub repository to correspond to the code deployed behind an MCP URL. A server could advertise a benign collection of tools while its backend contains additional behavior activated under particular circumstances. 15,465 MCP Servers, 0 Governance

That creates an uncomfortable distinction between tool approval and infrastructure trust.

Security teams may review what a tool claims to do, approve it and consider the job finished. But unless they can establish who operates the endpoint, what code is deployed there and whether those conditions change, they haven't necessarily established the trustworthiness of the thing their agent is actually communicating with.

## When "don't ask me again" becomes the vulnerability

OX tested what that trust can mean once an AI agent has permission to act. Researchers created a malicious MCP server masquerading as a code-scanning tool and tested it against Claude Code paired with Haiku 3.5\. The agent initially requested permission to access a harmless, non-sensitive file. The user selected an always-allow option — effectively, "don't ask me again."

The server subsequently requested sensitive files, including `.env`, and the request executed without another user approval prompt.

OX repeated the attack against Opus 4.6 and 4.7, where the injected prompt was detected and the tool call blocked. The researchers therefore caution that the behavior was model- and configuration-dependent and should **not** be interpreted as evidence that every Claude Code deployment is susceptible to the attack. 15,465 MCP Servers, 0 Governance

Anthropic's response to OX draws an important line between permissions and model defenses. The company told researchers that once a user explicitly grants always-allow permission, subsequent calls to that tool execute without another prompt by design. Anthropic characterized model-level prompt-injection detection as a defense-in-depth measure rather than a security boundary. 15,465 MCP Servers, 0 Governance

As agents receive more autonomy, the security boundary can't simply be "hopefully the model notices something malicious."

## MCP brings the shadow IT problem to AI agents

MCP, introduced by Anthropic in 2024, provides a standardized way for models and agents to interact with external tools and data sources. That interoperability is a large part of its appeal.

But interoperability also expands the trust chain.

Developers can connect MCP servers to coding assistants and other agentic environments for code reviews, repository management, browser automation, application-data access and other work. Those connections can originate directly from developer machines rather than through the traditional enterprise application perimeter. 15,465 MCP Servers, 0 Governance

That means an MCP server doesn't necessarily need an exotic exploit to create a security problem. If an agent sends proprietary code to an infrastructure endpoint the organization didn't know existed, the governance failure has already happened.

The OX research ultimately points toward a deceptively simple question that security teams should be asking every time an MCP server enters the environment:

Who — and what — are we actually trusting? Enterprises spent years building cloud controls around IAM, Zero Trust, data residency, supply-chain auditing and infrastructure visibility. MCP solves a different problem: It standardizes how agents and tools communicate. It does not establish who should operate those tools, where they should run, what data they should receive or whether deployed code matches reviewed source code. 15,465 MCP Servers, 0 Governance

OX's conclusion captures the danger of forgetting that distinction: MCP made integration easy, but it did not make "jurisdiction, custody, or server integrity part of the deal." 15,465 MCP Servers, 0 Governance

For security leaders, that suggests the next stage of AI governance can't stop at approving models, agents or tools.

The infrastructure behind those tools has to enter the threat model, too.

###