The MCP protocol went from launch to 10,000 active public servers in thirteen months. That’s not hyperbole — Anthropic published the standard in November 2024, and by December 2025 it had deployment support from AWS, Google Cloud, and Azure, with ChatGPT, Gemini, Copilot, Cursor, and VS Code all speaking it natively. No infrastructure standard in the AI space has moved this fast, and security teams are feeling the whiplash.
What’s actually on the line became clearer when Lakera — the AI security firm Check Point acquired in 2025 — ran an analysis across those 10,000 servers. The result: 40% carried exploitable weaknesses. That’s not a rounding error. The attack patterns OWASP has catalogued are specific and nasty. Tool poisoning embeds malicious instructions directly in schemas or tool descriptions, hijacking agent behavior before a human ever sees a prompt. Rug pulls change a tool’s definition after approval, exploiting the exact moment a human said “this looks fine.” Tool shadowing lets one malicious server manipulate how an agent uses tools from a completely different, trusted server.
Check Point’s answer arrived in July 2026 with the AI Network Firewall, squarely aimed at this second-generation firewall category — the kind that defends AI models and agents themselves, not the older AI-powered firewalls that just filter conventional malware. But here’s the thing worth keeping in perspective: MCP is one thread in a much larger security fabric. Agents connect to tools and data through plenty of channels that never touch MCP, so locking down MCP servers alone won’t save you.
The uncomfortable reality is that MCP’s adoption curve outpaced security by design. The protocol’s entire value proposition is frictionless connection — one interface, many tools, no custom connectors. That convenience is the attack surface. Vendors are now racing to bolt protections onto infrastructure that was never built with hostile tool descriptions in mind, and the 40% figure suggests they’re starting from a deep hole.
