It takes about three minutes to connect an AI agent to your company’s GitHub, Slack, or production database. No procurement process. No security review. No IT ticket — just a Model Context Protocol (MCP) server pulled from a public registry and a few lines of config.
That convenience is exactly what makes Shadow AI and Shadow MCP one of the fastest-growing attack surfaces in enterprise security. And most security teams don’t know it’s already inside their environment.
The Attack That Started With a Public GitHub Issue
In May 2025, researchers at Invariant Labs disclosed a critical vulnerability in the official GitHub MCP server the reference integration used by AI coding assistants like Claude Desktop to interact with repositories on a developer’s behalf.
The setup was ordinary. A developer connected their AI assistant to GitHub using a single access token that, like most developer tokens, had access to both public and private repositories.
Here’s what happened next:
An attacker planted a prompt injection payload inside an issue on a public repository. Plain text. No malware. No exploit code. When the developer’s agent reviewed that issue, it followed the embedded instructions to retrieve files from a specified private repository and post them as a comment on the public issue.
The agent complied, using permissions it legitimately held, in a sequence nobody had explicitly authorized.
Invariant Labs demonstrated the technique against their own test repositories and extracted private project roadmaps, an employee’s relocation plans, salary data, and a JWT secret all through a single public comment.
No credentials were stolen. No zero-day was involved. The agent simply did what any well-behaved, fully-permissioned tool would do when it trusted the wrong input.
Security researchers now call this pattern a toxic agent flow: a sequence of individually authorized actions that, chained together, produces an unauthorized outcome.
What Is Shadow AI? What Is Shadow MCP? And Why the Difference?
Shadow AI is the current name for an established problem: employees using AI tools, apps, or services without the knowledge or approval of IT and security teams. It’s the ChatGPT tab pasted with source code, the personal Copilot subscription processing proprietary data.
Shadow MCP is a more specific and more dangerous subset of that problem. It refers to unauthorized or unmanaged Model Context Protocol servers connected to enterprise AI workflows. In practice, it’s developers or AI IDEs installing MCP servers that give an AI agent direct, tool-calling access to databases, file systems, internal APIs, and CI/CD pipelines.
The distinction matters because the risk compounds at each stage:
An MCP server isn’t a chat window. It’s a bridge that lets an AI agent ask “what tools are available?” and then invoke them on demand, query a database, read a file, call an API, run a shell command. A single ungoverned MCP server can give an agent a path across an entire corporate environment.
That is why security researchers increasingly treat Shadow MCP as a materially more dangerous problem than Shadow AI alone, not a rebrand, but an escalation.
The pattern across every one of these reports is the same: adoption has outrun governance, and the gap is measured in double digits, not the occasional edge case.
The OWASP MCP Top10: Shadow MCP Now Has a Formal Risks Framework
The OWASP Foundation now maintains a dedicated MCP Top 10 (currently in beta, version MCP01:2025 through MCP10:2025), tracking risk categories specific to Model Context Protocol deployments. This is a signal that Shadow MCP has moved from “emerging concern” to a recognized, structured category of vulnerability with its own audit framework.
Here are the risk categories most relevant to Shadow AI and Shadow MCP exposure:
Tool Poisoning in the Wild: The Supabase Cursor Incident
Tool poisoning isn’t theoretical. In mid-2025, security researcher Simon Willison and the team at General Analysis documented a critical vulnerability in Supabase’s Cursor agent integration. The AI agent ran with privileged service-role access and processed support tickets containing user-submitted input.
An attacker embedded SQL instructions inside a support ticket. When the Cursor agent processed the ticket, it executed those instructions reading sensitive integration tokens and writing them back into the public ticket thread.
The delivery mechanism was different from the GitHub MCP exploit, but the underlying failure was the same: an agent with legitimate access treating untrusted input as trusted instructions. Willison described the pattern as the “lethal trifecta” privileged access, untrusted input, and an external channel for data exfiltration, all present in a single MCP integration.
Why Traditional Security Tools Miss Shadow MCP Activity
A conventional WAF or DLP tool is built to inspect predictable, stateless web traffic and match it against known signatures. MCP breaks both of those assumptions.
MCP connections are persistent and stateful — closer to an open tunnel between an AI client and a server than a one-off HTTP request. The connection stays alive as the agent calls tools, processes responses, and chains actions together.
Sensitive data never crosses a traditional inspection boundary. Because MCP tool responses flow through the client’s own process directly into the model’s context, PII, credentials, and proprietary code inside those responses never traverse a network path a conventional proxy or DLP tool would inspect.
MCP servers are trivially easy to deploy. With hundreds of published MCP server packages available on public registries — for Postgres, GitHub, Slack, AWS, and more — installing one takes minutes. No procurement process, no security review, no approval workflow stands in the way. Governance built around annual audits or perimeter firewalls simply cannot catch something that gets deployed between two audit cycles.
The result: security teams have a blind spot that grows every time a developer or AI IDE connects a new MCP server without going through official channels.
How to Defend Against Shadow AI and Shadow MCP
Closing the Shadow MCP gap requires the same discipline that already applies to shadow APIs — extended to cover the agents and tool-calling servers now sitting on top of them.
Continuous Discovery — You Can't Secure What You Can't See
Since MCP servers can be installed in minutes with no procurement process, periodic audits will always lag behind deployment. Security teams need real-time visibility into which APIs and endpoints AI agents are actually calling — including connections from MCP servers that were never formally approved.
Behavioral Detection — Look for Patterns, Not Signatures
A toxic agent flow doesn’t trigger a signature match. Each individual request looks legitimate. The threat is in the aggregate — a caller that follows a sequence no human explicitly authorized. Detection must shift from per-request inspection to behavioral analysis across sessions.
API Governance — Secure the Layer MCP Depends On
Every MCP server ultimately calls an API. If the API layer is ungoverned — shadow APIs, forgotten endpoints, over-permissioned tokens — the MCP server inherits and amplifies those exposures. API security and governance is the foundation that MCP security sits on.
AI-Specific Protections — Prompt Injection and Model Poisoning Defense
Shadow MCP compounds existing LLM risks. Prompt injection payloads embedded in GitHub issues, support tickets, and documents can hijack agent reasoning. Defense at the AI layer — OWASP Top 10 for LLM protection, prompt injection detection, and model poisoning defense — must be part of the same policy engine that governs application traffic.
How Prophaze Addresses Shadow AI and Shadow MCP Risk
Prophaze’s AI-native WAAP platform is built around this continuity rather than treating AI-specific risk as a bolt-on:
- AI Security Layer — OWASP Top 10 LLM protection, prompt injection defense, and model poisoning detection built into the same policy engine that governs the rest of application traffic.
- Runtime API Discovery — continuous discovery of shadow and forgotten APIs, the same blind spot an ungoverned MCP server exploits to reach production systems.
- Behavioral Threat Detection — real-time analysis tuned to catch a caller that looks legitimate per-request but abnormal in aggregate, the pattern an adaptive agent produces.
- API Security & Governance — protection, visibility, and policy enforcement across the APIs that MCP servers and AI agents call on an organization's behalf.
- Can you see every AI agent talking to your systems right now?
Shadow MCP doesn’t announce itself; it shows up as a normal-looking request from a tool nobody approved. Prophaze helps security teams get visibility into that traffic before an ungoverned agent finds the credential or endpoint nobody was watching.
Frequently Asked Questions (FAQ)
1. What is the difference between Shadow AI and Shadow MCP?
Shadow AI refers to employees using AI tools without IT approval largely a data-exposure risk through chat interfaces and personal AI accounts. Shadow MCP is a more specific and severe subset: unauthorized Model Context Protocol servers that give AI agents direct, tool-calling access to databases, APIs, and file systems. The potential impact of Shadow MCP is far greater because the agent can autonomously execute actions against production systems, not just process text.
2. Is Shadow MCP a real, documented risk or a theoretical one?
It is documented. The GitHub MCP toxic agent flow, disclosed by Invariant Labs in May 2025, demonstrated private repository data exfiltration through a prompt injection in a public issue. The Supabase Cursor tool-poisoning vulnerability, documented by General Analysis and highlighted by Simon Willison in mid-2025, showed SQL-level data exfiltration through a support ticket. OWASP now tracks Shadow MCP Servers (MCP07) as a formal risk category in its MCP Top 10 framework.
3. Can a standard WAF or DLP tool catch Shadow MCP activity?
Not reliably. MCP connections are persistent and stateful rather than one-off requests, so a conventional WAF that inspects individual HTTP transactions will miss the context of a multi-step agent interaction. Sensitive data returned by MCP tools flows directly into a model’s context without crossing a network boundary a traditional proxy would inspect. Detecting Shadow MCP requires behavioral analysis and runtime API discovery, not signature matching.
4. What is a toxic agent flow?
A toxic agent flow is a sequence of individually authorized actions by an AI agent that, when chained together, produces an unauthorized outcome. Each tool call in the chain uses permissions the agent legitimately holds, but the composition of those calls triggered by a prompt injection achieves something no user explicitly authorized, such as reading private data and posting it to a public channel.
5. What is the first step toward reducing Shadow MCP risk?
Continuous discovery. Since MCP servers can be installed in minutes with no procurement process, periodic audits will always lag behind deployment. Security teams need real-time visibility into which APIs and endpoints AI agents are actually calling before an ungoverned agent reaches a credential, database, or internal service nobody was watching.
6. What is the first step toward reducing Shadow MCP risk?
The OWASP MCP Top 10 is the OWASP Foundation’s first dedicated security framework for Model Context Protocol deployments. It catalogs the ten most common risk categories including token mismanagement, tool poisoning, command injection, Shadow MCP servers, and supply chain risk. The framework is currently in beta (version MCP01:2025 through MCP10:2025) under the lead of Vandana Verma Sehgal, and represents a formal recognition that MCP has introduced a distinct, auditable attack surface.
