What a Year of Breaking MCP Tells Builders
RAI Amsterdam · 17 September 2026 · Amine Raji, Molntek
Every MCP deployment I looked at had a trust check, and every check compared a string to something nobody had issued, verified or bound to an identity. The talk reproduces a year of MCP vulnerabilities across three anchors (the session, the network and the approval dialog), weighs what the July 2026 specification fixed and the two surfaces it opened, and ends with a claim I withdrew on stage: that more capable models are easier to poison.
Material from the talk
Three things to do on Monday
If you take nothing else from the session, take these.
- 1
Verify the publisher before you verify the content. Approval bound to a name is not approval: postmark-mcp shipped faithful copies through 1.0.15 and added one BCC line in 1.0.16.
- 2
Authenticate inbound separately from downstream. A personal access token that authenticates your server to GitLab authorises nothing about the caller reaching your server.
- 3
Snapshot the definition surface and block on drift. If a tool description, server list or config changed since you approved it, stop rather than re-read it.
Score your own agents, free
The Agent Security Scorecard asks the same questions I use in a paid review and gives you a gap list in the browser. No login, no email, nothing to install. It is the fastest way to find out whether what you just heard applies to you.
Open the Scorecard →If you want this run against your own system
That is what I do for a living. The two-day AI Security Sprint is €3,500 and answers one question properly: where the real exposure sits in the system you are least sure about. Prices for everything else are on the services page, and I would rather tell you on a call that you do not need me than sell you something you do not.