MCP: The "USB-C for AI" or the "USB stick for malware"?

Model Context Protocol (MCP), introduced by Anthropic, is rapidly emerging as a standard for connecting AI agents to tools, data sources, and external systems. It promises to solve the "m × n" integration problem, allowing AI assistant like Claude to seamlessly plug into anything.

MCP is likened as the USB-C of AI, but this convenience comes with a dangerous trade-off. MCP effectively grants AI agents dynamic, runtime access to APIs, filesystems, and services, often with minimal security boundaries. As the ecosystem of MCP servers and adoption among enterprise teams and solo developers alike grows rapidly, security has taken a back seat to capability. The result: a new and poorly understood attack surface where prompt injection, tool abuse, and supply chain compromise intersect.

In this talk, we’ll explore why MCP is both transformative and risky. We’ll demonstrate how indirect prompt injection can turn an AI agent into a malicious insider, triggering unintended tool execution, leaking sensitive data, or even enabling remote code execution. We’ll also examine emerging attack vectors such as "tool poisoning," "rug pull", malicious MCP servers, "confused deputy", excessive agency, and data exfiltration via seemingly benign UI behavior. We will learn from some real world MCP Server security incidents that have already occurred. 

Beyond breaking things, we’ll focus on how to fix them. We’ll map these risks to the OWASP LLM Top 10 and provide practical, implementable defenses from least privilege and sandboxing to provenance, validation, Input/output filtering, authorization for a MCP-aware security architecture.