Early protocol decisions become systemic risk, and MCP is the current case study

Security researchers describe a systemic command injection issue in MCP that propagated across the AI ecosystem — and the framing in the disclosure is the important part: design decisions made early in a protocol's life create systemic risk later.

Protocol flaws do not stay local

An application vulnerability affects that application. A protocol vulnerability affects every implementation that followed the specification correctly, which is the opposite of how a bug usually distributes. Diligence does not protect you; conformance is what exposes you.

It is also unusually hard to fix. An application is patched by its maintainer. A protocol is fixed by coordinating every implementer, every deployment and every intermediary that speaks it, most of whom have no relationship with each other and no shared release cadence.

A protocol is a decision you make once, for everyone, and cannot easily take back.

Why this keeps happening to young protocols

The pressure at the start of a protocol's life is adoption. Simple beats complete, permissive beats strict, and every constraint is friction against the thing that determines whether the protocol survives at all. The decisions that look reckless in the incident report looked like good judgement when the alternative was irrelevance.

MCP is not unusual here. SMTP trusted the sender. HTTP had no notion of identity. SNMP shipped with a default community string. Each was correct for its context and each became a decade of remediation once the context changed.

What this means for building on it

Not that MCP should be avoided — it is genuinely useful and the direction is right. But building on a protocol this young means accepting that its security properties are still being discovered, and that some of what is discovered will not be patchable at your layer.

Practically: keep an abstraction between your systems and the protocol so a breaking security change does not require rewriting your application. Do not let protocol-level trust substitute for your own authorisation. And assume the threat model will change under you at least once more, because on the evidence of every protocol that came before, it will.

Written by the Devence Lab research team.