OX Security analysed 15,465 MCP servers and 5,095 unique hostnames, finding that 15.6% of the hostnames resolved to infrastructure outside the United States. The researchers identified 19 in China and 18 in Russia, raising questions over data residency and organisations’ ability to enforce geographic restrictions on information handled by AI agents.
MCP, an open protocol originally introduced by Anthropic, provides a standard way for AI applications and agents to connect with external tools, data sources and services. Its rapid adoption has simplified integrations, but security researchers say the same flexibility can allow connections to infrastructure that corporate security teams cannot readily inventory, verify or govern.
OX said MCP itself has no protocol-level mechanism for enforcing where a connected tool operates or where information is processed. That can weaken controls built around cloud infrastructure, including identity and access management, audit logging, supply-chain review and data-residency policies.
The study also found 0.45% of analysed hostnames associated with consumer internet service provider networks or personal tunnelling tools. Such configurations can place AI workflows on home networks or locally hosted machines, potentially outside centralised enterprise monitoring and access controls.
Another 2.3% of the hostnames examined no longer resolved. Among them, researchers found six unregistered domains available for purchase for between $4 and $12 a year. OX warned that an attacker acquiring an abandoned domain could potentially inherit trust from MCP clients or workflows still configured to connect to the former endpoint.
The findings add to broader concern about how enterprises authenticate, authorise and monitor agentic AI connections. An MCP Enterprise Interest Group catalogue published this year identified limited administrator visibility into MCP server connections as a deployment problem. It noted that employees can connect servers to business applications without administrators necessarily having a protocol-level way to discover, approve or revoke those connections.
Academic research has raised related issues. A September study examining six MCP software development kits identified shortcomings affecting enterprise zero-trust deployments, including the absence of fine-grained per-tool authorisation in base SDKs and complications around serving human users and automated agents under different credential models.
OX separately tested whether permissions granted to an MCP server could persist beyond their intended purpose. Using Claude Code with Anthropic’s Haiku 3.5 model, researchers said a malicious server used prompt injection after receiving an “Always-Allow” permission for a benign file request and subsequently accessed a sensitive. env file without another user confirmation.
The same attack was blocked in OX testing with Anthropic’s Opus 4.6 and 4.7 models, indicating that model behaviour and safeguards can affect whether a malicious instruction succeeds. The test nevertheless highlighted the risk of treating an earlier permission as durable trust when the behaviour of a connected server can change.
Security specialists have increasingly focused on MCP as AI agents gain permission to retrieve data and perform actions across corporate systems. Unlike conventional integrations that enterprises may provision through centrally managed gateways, MCP servers can be added by developers or users and may be operated by third parties whose infrastructure, software version and ownership are difficult for an organisation to verify.
Microsoft has described inventory, secure-by-default architecture and automation as elements of its internal approach to MCP governance. Its security teams have focused on questions including who may connect, what data can be exchanged and how agent communications should be controlled.
OX researchers said inspecting publicly available server code does not necessarily establish what software is actually running at an endpoint. Server operators can deploy another version, alter code later or collect data in ways that are not evident from a repository, making continuous verification important.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
