MCP's largest spec revision since launch ships with a prompt-injection flaw that can leak credentials.
The AMW Read
A newly found credential-leak vulnerability in MCP's largest-ever spec revision, adopted ecosystem-wide within a day, is a structural safety risk across agentic tooling rather than one vendor's product flaw.
MCP's largest spec revision since launch ships with a prompt-injection flaw that can leak credentials.
On July 28, the Model Context Protocol shipped its largest specification revision since launch, and all four Tier 1 SDKs adopted it within a single day — fast even for a de facto standard now embedded across agentic tooling. Security researchers then found the updated spec allows a planted prompt in content an agent processes to be escalated into stolen credentials, without a compromised server or a malicious tool author.
MCP is the default interoperability layer connecting AI agents to external tools and APIs, so a flaw in the spec itself — not a single implementation — reaches every agent and vendor that adopted the new version, which the one-day rollout makes effectively the whole ecosystem. Prompt injection remains one of the hardest AI-agent vulnerabilities to close, so a credential-leak path built into the protocol layer raises the stakes for any deployment where an agent can reach secrets or authenticated sessions.
Builders on MCP-based tool-calling should treat the current spec as untrusted pending a patch, audit which credentials their agents can reach, and add injection detection or scoped-credential boundaries rather than rely on the protocol's default trust model. Investors in agent-infrastructure startups should ask how each vendor isolates credentials from model-processed content, since a protocol-level flaw like this sits upstream of any single company's own security work.