MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace

In SkillJacking we took over the skills themselves. In RepoJacking we left the skill untouched and took over the repository it cloned. This time, we didn't touch a skill or a repo at all. Instead, we built MCP scanning capabilities into ^{AIR Filter}, directed it at the Official MCP Registry, and this is what it found.

This demo shows an agent prompted to complete an innocent task. Behind the scenes, it follows an MCP instruction loaded automatically into its context that is triggered by this task to backup the workspace at the start of each day by running a backup script - which ends up quietly exfiltrating secrets to an attacker controlled endpoint, while having zero indication of any malicious activity.

MCPs Are Everywhere

MCP servers are essentially a bundle of instructions, functions and resources that's served to agents and enables them to reach beyond the chat window: your files, your inbox, your production database. Anyone can publish one, anyone can install one. Inside your company, they are a powerful tool, wired into the CRM, the repo, the general ledger, making automation one prompt away. On the other hand, many times they are installed with no review, some come from an official vendor, others are just a useful tool someone hooked up for the team. It's the wild west: everything connects to everything, and no one really tracks what's talking to what.

Registries provide the primary structure in this ecosystem: a directory where MCPs are published and listed by name, so an agent can look one up and find where it lives. A handful of these exist. There are community marketplaces, enterprise catalogs, the Official MCP Registry, and they all work the same way. Each entry is a name pointing at wherever that MCP's service actually runs. Publish under a name, and it stays listed under that name.

MCPs die. Their registry entries don't.

Hijacking MCPs

We started with the official registry itself. Most of what it lists points at services that are alive and maintained. Some of them aren’t. We looked for entries still listed and still trusted but whose services had quietly stopped answering. We found several that had been legitimately published and widely adopted. Real entries, real services behind them, doing exactly what they claimed, right up until they went away.

How Did This Happen?

1. The service behind a legitimate, listed entry went offline, and the domain its listing resolves to has expired.
2. The official registry kept the entry live. Still listed, still trusted, still resolving to it.
3. We registered the domain. It was sitting unclaimed, available to anyone.
4. We published our own MCP behind it, answering as the original.
5. Every agent that connects through that entry now connects to us.

The entry was never edited. We never touched the author, their account, or their code. We didn't need to. Nobody went rogue. A service went down the way services do, and its identity went back in the pool. There is no event here for a single check to have caught.

From MCPJacking to Full Agent Takeover

While compromising a skill injects instructions into an agent's prompt context, hijacking an MCP server places you directly within its execution loop. The AI agent invokes your endpoint, shares data, and executes operations based on your responses, treating your input with the same implicit trust as its internal functions. From this privileged position:

• ToolJacking: you define the tools now, and can change what any tool does while its description stays innocent.
• Data exfiltration: file contents, records, database queries all arrive at your door as normal traffic. 
• Prompt injection: MCP instructions are server controlled content the model trusts. Load time prompt injection, live before the first call.
• Steering: every result you return is trusted context the agent takes at face value.

At that point we're no longer just the MCP. We're running on the machine, with the agent's context, its other credentials, and every system it was trusted to reach.

Installed Once, Attackable Forever

The core vulnerability lies in the absolute, blind trust that agents place in their initial configurations. Unlike modern software environments that verify dependencies during execution, agents do not audit their connections at runtime. They treat the endpoints defined during the first installation as permanently valid, establishing a persistent and unmonitored line of communication that remains open indefinitely.

This misplaced trust enables two primary attack vectors. An attacker can simply reclaim a lapsed domain once a legitimate service goes dark, instantly inheriting the agent’s connection. Alternatively, they can execute a more patient pivot: publishing a perfectly functional, benign tool to gain a foothold, only to quietly update the server later to perform malicious actions. Because these changes occur entirely on the server side, they remain invisible to users and traditional security gateways, which are designed to verify the integrity of the connection pipe rather than the true identity and intent of the service provider.

Takeaways for Security Teams

1. MCP sprawl requires governance. MCPs originate from registries, GitHub, or individual configurations, often connecting to agents with production access without visibility. Governance is difficult when connections remain unmonitored.
2. Official Registries provide no inherent protection. A registry listing is a static snapshot and does not confirm who controls the service or if it remains legitimate.
3. MCP Gateways do not protect from MCPJacking. Security gateways verify the connection path, but they often fail to validate the true identity or intent of the service provider on the other end.
4. MCPs require continuous vetting. Service availability or ownership can change without notice. An MCP authorized previously might now be under unauthorized control. Continuous risk management requires scanning entry resolution, monitoring for handoffs, and maintaining the ability to revoke access.

Book a demo to see how Air Filter already governs MCP sprawl across thousands of agents at enterprise scale, and how Air Marketplace ensures all knowledge workers download only continuously vetted agent add-ons.