MCP Server Security Risks in Multi-Tenant Enterprise Environments

Multi-tenant enterprise environments introduce a distinct threat surface for MCP servers, where tenant isolation failures, over-scoped permissions, and shared tool access can cascade across accounts, and understanding these compounding risks is the first step toward governing MCP deployments at scale. This piece walks through why that's true, using the incidents and numbers that made it undeniable.

Why MCP servers create a fundamentally different security problem than traditional APIs

MCP works as a standardization layer. Instead of an agent needing custom integration code for every system it touches, it discovers and calls tools through one consistent protocol, which is the entire appeal and, as it turns out, the entire problem. The architecture runs in a chain: a host application, the AI system itself, talks to a client that manages the connection, which talks to a server that exposes tools and data, which talks to whatever enterprise system sits behind it. Through that chain, an agent can read files, write to databases, call external APIs, and modify production systems, all without a human writing a line of integration code⟧.

Before MCP, every integration required custom code, and writing custom code forced teams to reason through authentication and permissions whether they wanted to or not. MCP removes that friction, and removing friction from integration also removes it from security review; a team can skip thinking about auth just as easily as they can skip writing a connector by hand. Pomerium's 2026 analysis makes the protocol gap explicit: MCP as specified includes no built-in authentication or authorization, so every server inherits whatever permissions it happens to be granted, and every agent request flows through unverified unless someone bolts on controls from outside the protocol MCPTox benchmark.

That's what makes this categorically different from API security. An API has a defined trust boundary. MCP's trust chain spans the user, the AI host, the MCP client, the MCP server, and the downstream system, and any single link in that chain can be manipulated to compromise the rest. Checkmarx's 2026 guidance draws the distinction cleanly: trusting a client doesn't mean trusting every server it connects to, and approving a server doesn't mean every tool it offers is safe for every user who can reach it MCPTox benchmark. Those are two separate approval boundaries, and conflating them is how a lot of these incidents start MCPTox benchmark labs.cloudsecurityalliance.org.

Scale makes the abstraction concrete. Mend.io counted more than 4,500 public MCP servers available for integration by 2026, with weekly NPM installations exceeding 4.7 million by mid-2025 MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. Each one of those is a potential exposure point sitting inside somebody's enterprise network, waiting to be discovered by an agent and trusted by default.

How far security has lagged behind MCP's move into production

Anthropic released MCP in late 2024, and adoption spread across every major LLM provider within the first half of 2025 MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. That's a genuinely fast timeline for enterprise infrastructure. Team8's CISO Village Survey found 70% of enterprises already running AI agents in production, with another 23% planning deployment in 2026 Team8 CISO Village Survey MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management.

Witness.ai projects that 40% of enterprise apps will feature task-specific AI agents in 2026, up from under 5% in 2025 Clutch Security MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. That's not incremental growth; it's a phase change. But here's where the story turns: Clutch Security found that 86% of MCP servers run locally on developer machines, with only 5% running in actual production environments MCPTox benchmark. The controls organizations assume exist in production (network segmentation, monitoring, access review) simply aren't present for the overwhelming majority of these deployments, because the overwhelming majority of these deployments never went through a production pipeline in the first place Clutch Security MCPTox benchmark.

Security staffing tells the same story from a different angle. Organizational concern about AI security jumped from 17% in 2024 to 48% in 2026, the Linux Foundation's State of Tech Talent Report found, and while 97% of organizations say they're committed to AI implementation, 57% report a real capacity gap in security and risk management The Linux Foundation 2024 State of Tech Talent Report MCPTox benchmark. Everyone's worried. Fewer than half have the staff to do anything about it.

Regulators are responding, just slower than the deployment curve. NIST's AI Agent Standards Initiative launched in February 2026, with an interoperability profile expected in the fourth quarter of 2026, and MITRE's ATT&CK ATLAS framework added 14 new agent-focused techniques in October 2025 MCPTox benchmark MITRE ATT&CK ATLAS framework KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. None of that was fast enough to get ahead of the problem. Speed of adoption was never really the issue here. Deploying at that speed without governance infrastructure to match it, that's the issue, and it's exactly the gap that multi-tenancy exploits.

Multi-tenancy's added threat surface: isolation failure, shared context, and cascading blast radius

A multi-tenant MCP environment is one where multiple organizations, or multiple business units within one organization, share server infrastructure, a pooled tool registry, or a common agentic platform layer. Sharing infrastructure is efficient. It's also how one tenant's mistake becomes every tenant's incident.

Asana found this out in April 2025 MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. The company launched an MCP-based integration letting AI tools query enterprise project data, and shortly after launch a vulnerability surfaced that could have exposed one organization's information to other users of the same MCP system MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. Asana pulled the feature offline for nearly two weeks, patched it, and reset every user connection before bringing it back MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. This wasn't a hypothetical researcher's proof of concept. It was a production deployment at a real company where tenant separation failed under actual operating conditions, which is precisely why early-stage MCP deployments deserve more suspicion than they usually get.

The protocol's own mechanics don't help. The MCP specification dated July 28, 2026 replaces persistent sessions with tracking identifiers and state objects that servers manage and pass to clients, and Akamai's analysis notes that predictable identifiers in that scheme can be exploited for workflow hijacking and unauthorized cross-tenant data access MCPTox benchmark. Add a shared tool registry to that picture and the math gets worse fast: one poisoned tool definition, sitting in a pool multiple tenants draw from, reaches every agent in every tenant that calls it. Blast radius scales directly with how many tenants share the registry.

Over-scoped permissions compound the same failure. MCP servers serving many clients tend to inherit broad permissions by default, because the permission set has to accommodate whichever tenant needs the most access, and least-privilege enforcement becomes close to impossible once that's the baseline. Checkmarx's 2026 research frames the resulting cascade this way: a compromised MCP server doesn't just affect the tenant where the breach begins, it can act as a lateral movement bridge to sensitive databases or internal tools serving other tenants, bypassing traditional network perimeters MCPTox benchmark. In a single-tenant setup, a misconfiguration stays bounded to whoever made it. In a multi-tenant one, that same misconfiguration gets inherited, shared, and propagated.

Tool poisoning: the attack vector that exploits shared tool definitions at scale

An agent reads a tool's description with the same trust it extends to its own system prompt. Bury malicious instructions inside that description, and the agent follows them silently, with no user ever seeing it happen.

What makes this worse than a one-off prompt injection is persistence. A poisoned tool description ships inside a package, a config file, or a remote server, and it executes on every invocation, across every session, for every user, until somebody notices MCPTox benchmark. There's a variant nicknamed the rug pull: a tool that was safe at install time gets updated afterward with malicious instructions, and because MCP clients pick up description changes on the fly without requiring re-approval, the poisoned version goes live with zero additional review MCPTox benchmark. Attackers have also registered tools with names deliberately close to legitimate ones, betting that the model picks the wrong server's tool without anyone catching the swap.

The numbers on how often this works are not comforting. The MCPTox benchmark tested adversarial variants of 353 real tools pulled from 45 live MCP servers against 20 different language models, and found an average attack success rate of 36.5% across the board, with the worst-performing model failing 72.8% of the time against a leading reasoning model Clutch Security. Even the most resistant model in the study still complied with poisoned instructions more than a third of the time Clutch Security MCPTox benchmark. Trail of Bits demonstrated a real tool poisoning attack that silently exfiltrated a user's entire chat history, credentials, tokens, and intellectual property included, and a separate 2026 disclosure found up to 200,000 vulnerable MCP instances across IDEs, internal tools, and cloud services itecsonline.com MCPTox benchmark. In a shared tool registry, one rug-pull update to one tool definition reaches every tenant whose agents have already discovered that tool.

None of this is a configuration mistake somebody could patch with a stricter setting. Witness.ai points to the architectural root cause identified in recent research: the server returns tool metadata through a tools/list call, and the client feeds that metadata straight into the model's context window with no built-in validation step MCPTox benchmark. That's baked into how the protocol works, not a setting someone forgot to flip.

Prompt injection, SSRF, and command injection: how attackers move laterally across tenant boundaries

The Cursor incident is the clearest illustration of indirect prompt injection in the wild. An attacker's crafted input caused Cursor's AI agent to generate a malicious.cursor/mcp.json configuration file without the user ever approving it, and the resulting configuration gave the attacker remote code execution. A separate case involved a booby-trapped GitHub Issue: a developer's agent, reading through the GitHub MCP server, got redirected into the user's private repositories and exfiltrated data by opening a pull request in a public repo. Neither of these required the attacker to touch the victim's machine directly. They just needed the agent to read something it trusted.

Server-side request forgery turns MCP servers into a gateway straight into cloud infrastructure. In a proof of concept against Microsoft's MarkItDown MCP server, researchers used SSRF to reach an EC2 instance's metadata endpoint and pulled out AWS IAM access keys, secret keys, and session tokens. One misconfigured server, one bridge into the cloud account behind it.

Pomerium's 2026 research names a specific misconfiguration called NeighborJack, where a server binds to all network interfaces instead of localhost, exposing command execution to anyone sharing the same network MCPTox benchmark. In a shared office network or a cloud subnet holding multiple tenants, that single setting turns the whole subnet into an attack surface. MCP doesn't enforce strict per-request authentication, so servers act on their own standing permissions instead of verifying who's actually asking, letting a caller borrow authority it shouldn't have while the server treats it as authorized. In a shared environment, that means any tenant's agent can potentially borrow another tenant's server authority, and the server has no way to know the difference.

Trend Micro has cataloged 102 MCP-specific CVEs, and this volume reflects how widely these vulnerability classes appear across implementations rather than one company's bad code. And the threat environment isn't holding still while enterprises figure out governance. IBM's X-Force 2026 Threat Intelligence Index recorded a 44% spike in AI-accelerated attacks IBM X-Force 2026 Threat Intelligence Index MCPTox benchmark. SSRF affects 36.7% of a sample of over 7,000 servers, according to BlueRock Security's MCPTox benchmark. Endor Labs' 2025 MCPTox benchmark findings, cited in KuppingerCole's 2026 Leadership Compass on Non-Human Identity Management, found path traversal affects 82% of implementations across a large tested sample KuppingerCole 2026 Leadership Compass on Non-Human Identity Management.

Shadow MCP services and over-scoped permissions: the ungoverned interior

Shadow MCP is the unglamorous version of this problem: unauthorized server instances that developers or teams stand up to move faster, running entirely outside any monitoring or policy enforcement MCPTox benchmark. Multi-tenant environments make this worse, not better. A developer inside a large organization sees MCP as a way to skip the wait for IT approval, and can point a server at a production database in an afternoon; once an agent discovers that server, its tools quietly become part of the available action surface for anyone the agent serves MCPTox benchmark. Scanning in February 2026 turned up more than 8,000 MCP servers exposed on the public internet, most of them unmanaged, plenty with no authentication at all MCPTox benchmark blog.cyberdesserts.com.

Over-scoped permissions are a standing risk rather than a one-time mistake. Servers keep access whether or not they're actively using it, which means a compromised server has maximum leverage at the exact moment somebody breaches it MCPTox benchmark. In a shared tool registry, that problem multiplies: a server has to satisfy whichever tenant needs the broadest access, and every other tenant inherits capabilities it never asked for and shouldn't have.

Investigating any of this after the fact runs into a wall, because many MCP servers produce no structured logs of what agents actually did MCPTox benchmark. Without attribution tying agent activity back to a specific human, forensic work after a cross-tenant incident is close to impossible MCPTox benchmark. Every server loaded at session start dumps its full tool schema into context regardless of whether those tools ever get used, and this carries an overlooked cost: research from Owens in 2026 measured overhead running from roughly 32,000 to 82,000 tokens per session MCPTox benchmark. In a shared environment, that's both a cost attribution headache and a real risk of context bleeding between sessions that were never supposed to touch MCPTox benchmark. If any server can enter the tool registry without being vetted, the enterprise loses the ability to reason about what its own agents are capable of doing, full stop. Gartner's 2025 forecast puts a number on where this leads: more than 50% of successful attacks on AI agents through 2029 will exploit access-control issues, and shadow, over-scoped deployments are squarely in that category MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management.

AI agent identity as the load-bearing problem in multi-tenant MCP governance

KuppingerCole's 2026 Leadership Compass on Non-Human Identity Management found that non-human identities now outnumber human users in many enterprises, in some cases by a factor of 25 to 50 MCPTox benchmark KuppingerCole 2026 Leadership Compass on Non-Human Identity Management. That ratio changes what identity governance even means. Traditional IAM was built around humans, who behave predictably and log in a finite number of times a day. Agents issue rapid, automated, high-volume tool calls that most existing policy enforcement was never designed to evaluate in real time.

Checkmarx's 2026 guidance lays out the full chain that actually needs governing: who the user is, which client is acting on their behalf, which server is being called, what token authorizes the call, what resource sits at the other end, and whether the specific tool action requested is actually permitted in that context MCPTox benchmark. Skip identity at the agent level, and in a multi-tenant setup, multiple agents from different tenants can end up sharing one server-level credential, which makes it impossible to attribute any given action back to a specific tenant or enforce policy per tenant at all. Short-lived, per-agent cryptographic credentials fix the worst of this: a compromised credential expires instead of sitting around as a standing attack surface indefinitely.

Discovery has to come before any of that works. Okta's Agent Discovery feature, announced at Oktane 2026, maps an agent's potential blast radius and captures real-time signals identifying relationships between client apps and resource apps, flagging when an unsanctioned agent gains access to critical data MCPTox benchmark. Paired with it is a Kill Switch capability that revokes active tokens at the agent gateway in real time, functioning as a circuit breaker for a cross-tenant incident that's actively unfolding MCPTox benchmark. Agents don't live at the network layer or the endpoint layer. They live in the application layer, wielding non-human identities with permissions that are often broad and rarely expire on their own. Governance has to meet them exactly there, or it isn't governing anything at all.

The enterprise-managed authorization extension in the 2026 MCP specification

The direction of travel in the 2026 specification is toward closing the gap that made all of the above possible in the first place: authentication and authorization stop being something bolted on by whichever vendor gets there first, and start being part of what the protocol itself requires a server to enforce MCPTox benchmark. An extension built around enterprise-managed authorization pushes that decision back to the organization running the server, rather than leaving it to whatever default the tool author shipped with. Given how far adoption has already outpaced governance, betting on speed alone would be a mistake.