I spent a year of my life believing that code could be law.
In 2017, I sat in a Beijing apartment at twenty-five, reading the Solidity source of a multi-signature wallet line by line. I was not paid. I found twelve logic flaws in the implementation, submitted them on GitHub, and told myself that if the code were honest, the system would be honest. That was the deal. That was the entire religion. The code would be the contract, the contract would be the truth, and the truth would not need a lawyer, a board, or a company's permission.
Nine years later, in the middle of a bull market that has already buried 2022 in a shallow and conveniently forgotten grave, the federal government of the United States is running AI agents on a protocol whose authors have publicly confirmed that its most dangerous behavior is intentional. And almost nobody is screaming.
Follow the fear, not the chart. The chart says MCP won. Let me show you what the specification says, because the specification is where the bodies are.
Here is the essential context, stripped of vendor gloss and marketing cadence. MCP โ the Model Context Protocol โ was released by Anthropic in late 2024 as an open standard for connecting AI models to external tools and data sources. Architecturally, it is not a breakthrough. It is a reorganization of things we already had: LSP-style resource abstraction, function calling, plugin architecture, bound together by a JSON-RPC handshake. It is a standard-level innovation wearing the costume of a paradigm shift. I say that not to diminish it โ standards are how ecosystems actually scale โ but to locate the risk correctly.
MCP's local execution model descends directly from the Language Server Protocol, the developer-tooling standard that taught a generation of engineers that a tool running on your own machine, under your own user account, can be trusted with your own files. That inheritance is the whole story. The threat model MCP shipped with was a developer's threat model โ one user, one machine, one trust boundary. The threat model MCP is now running inside is a federation's: many tenants, shared infrastructure, adversarial inputs arriving through channels no single operator controls.
The design philosophy is what matters. MCP was built to minimize integration friction, to make it trivial for anyone to plug a tool into a model and for any model to reach any resource. Two decisions followed from that philosophy, and both are now federal problems.
First: STDIO. When an MCP server runs locally, it executes operating-system commands directly through the standard input/output channel. This model is inherited from the developer-tooling world, where the default assumption was a single trusted user on a single trusted machine. It is a reasonable assumption for a text editor. It is a catastrophic assumption for a federated agent deployment.
Second: automatic link scraping. An MCP server can be configured to fetch and ingest links without any interaction from the AI model. This is a deterministic code path. No model judgment is involved, no reasoning step, no guardrail. The server fetches. That is the whole behavior.
Anthropic has confirmed, on the record, that the STDIO command execution behavior is intentional. They declined to modify the protocol. ClawSecure, the security firm that surfaced much of this, stated plainly that the defect lives in the protocol specification itself โ not in any single vendor's implementation. And the adoption numbers complete the picture. Of the publicly exposed MCP servers, only 8.5% use OAuth. Authentication is optional. It was designed as optional. When you make safety a feature a developer can skip, the ecosystem will skip it โ every time, without malice, simply because skipping is faster and shipping is rewarded.
Now scale that up. Roughly 15,930 public MCP servers. Bitsight identified more than 30,000 exposed AI agent instances spanning government, healthcare, and finance. The federal government is not experimenting on the periphery. It is deploying at the center, on a protocol whose security baseline was never written.
Let me be precise about what kind of failure this is, because the distinction determines whether it can be fixed at all.
A bug is a deviation from the design. A design decision is the design. When the auto-link scraping path executes without model interaction, there is nothing to align, nothing to filter, nothing to jailbreak. The code does what it was written to do. Every safety mechanism we have built for AI assumes the model is the locus of risk. Prompt filtering, content moderation, RLHF, constitutional AI โ all of it operates at the model layer. None of it touches a deterministic fetch loop inside a protocol server.
This is the insight I want you to hold, because it is the one the industry keeps walking past: we aligned the model and forgot to align the protocol. The more trustworthy we make the model, the more authority we grant it, and the more damage it can do when the channel beneath it is wide open. Alignment without protocol integrity is not safety. It is a well-mannered courier carrying a loaded weapon through an unguarded door.
I have audited enough contracts to recognize this shape. The flaws I found in 2017 were not crashes. The code ran perfectly. It did exactly what it said it would. The problem was that what it said was wrong โ the trust assumptions baked into the logic did not match the world the logic would operate in. MCP has the same silhouette. It assumes a trusted local, single-tenant environment. The federal government is deploying it into a remote, multi-tenant, shared-infrastructure reality. The assumption is the vulnerability. And you cannot patch an assumption at the implementation layer, because every implementation inherits it.
The supply-chain dimension compounds this. With roughly 15,930 public servers and a vulnerability rate somewhere between a third and four-fifths of them, the ecosystem has the shape of a city built overnight with no building codes. Any single compromised server becomes a pivot point โ a place where an agent's trusted reach becomes an attacker's trusted reach. And the proposed fix, the middleware and wrapper layer that the security vendors want to sell, is not free. Every wrapper adds inference latency, operational complexity, and a new surface of its own. You are trading one attack surface for another and paying rent on the difference. I have watched this movie in DeFi, where every 'risk management layer' bolted onto a protocol became its own oracle to exploit. Security middleware is not a solution to a protocol flaw. It is a tax on it โ a recurring payment to a third party for a problem the protocol's owner declined to solve.
Now the governance layer, which is where my stomach turns.
Three compliance frameworks are supposedly in play: FedRAMP 20x, COSAiS, and the NIST interoperability profile. All three exist on paper. None has landed. The NSA and CISA issued a joint advisory. The GSA ran a hackathon from September to November 2026. NIST launched a standards initiative in February 2026. And the advisory itself contains the quiet confession that matters: guidance is not authorization. There is no formal federal security baseline for MCP. The capability is ready. The compliance is not. Federal agents are running in a vacuum between 'technically deployable' and 'legally governable.'
This is the governance error I have watched recur in this industry for nine years. We deploy first and govern never, and then we call the resulting exposure a surprise. In DAO governance, I have argued for years that 'code is law' collapses the moment you inspect where the upgrade rights actually sit โ always with a handful of multi-sig signers, always a small set of humans deciding what the code is allowed to mean. MCP has reproduced this exactly. The protocol is open in name. The authority to change it โ and the decision not to โ rests with Anthropic. The federation is downstream of a private company's product philosophy.
And that philosophy, at this moment, is: do not fix the protocol; push the responsibility downstream. I want to be fair here, because it is easy to make this sound like villainy and it is not. This is a coherent strategy. It minimizes Anthropic's cost, preserves protocol stability, avoids admitting a specification-level flaw, and keeps the standard frozen long enough to entrench it. It is also, functionally, a decision to externalize risk onto every institution that trusted the standard. The cost did not disappear. It moved. It always moves. It moves to the operators, the agencies, the hospitals, the banks โ everyone downstream who assumed the protocol's authors had done the boring work of threat modeling.
Which brings me to the firm selling the antidote, and to the discipline every reader of this needs to practice.
ClawSecure is the source of much of this research, and the reporting that surfaced it discloses โ to its credit โ that ClawSecure is a commercial security vendor with a product to sell. It is also, per the same reporting, working with bipartisan congressional offices on a national standard for independent AI agent testing. Read that twice. The firm that discovered the problem is positioning itself to write the rule that governs the problem, and to sell the tool that satisfies the rule. This is not scandal. This is strategy, and it is old strategy. It is the same regulatory capture I watched in crypto, where the exchanges that lobbied for the rules ended up being the only entities large enough to comply with them.
I do not raise this to discredit the finding. The finding may be entirely correct, and the structural risk is real regardless of who names it. I raise it because an honest reader must price the incentive. A vendor whose revenue depends on a vulnerability persisting has a structural reason to amplify the danger and to understate the possibility of a clean upstream fix. That does not make them liars. It makes them interested. And interested sources are the ones you must verify hardest โ which is precisely the verification the reporting lacks. I have seen no independent third-party reproduction of the core findings. The risk narrative is load-bearing, and its foundation is a single commercial party with a product roadmap.
There is one more detail that betrays the evidence quality, and it is hiding in plain sight. The reported range of servers with exploitable vulnerabilities is 30% to 82%. That is not a measurement. That is the absence of a measurement. A spread that wide is the signature of missing methodology โ no shared test harness, no common definition of 'exploitable,' no reproducible scoring. It is exactly the gap a 'national standard for testing' would fill, and exactly the gap that benefits whoever gets to define the standard. When you see a number that can be almost anything, you are not looking at data. You are looking at a business plan with a confidence interval stretched over it.
There is an investment subtext here that the crypto reader will recognize instantly. The MCP security gap has created a clean thesis: agent security and compliance tooling. Demand is real, government budget is a moat, and standard-setting is the highest form of that moat. But the valuation is problem-driven. It depends on the flaw persisting. If Anthropic ever relents and ships protocol-level authentication, the moat evaporates overnight, and every thesis built on 'MCP is insecure' re-prices in a single announcement. That is the same fragility I have criticized in DeFi, where yields depend on conditions that exist only until they don't.
I also want to name the part of this that no vendor can sell you a fix for, because it is the part that should worry the people actually deploying agents in federal systems. The entire safety literature we have built assumes the model is the risk surface. We fine-tune it, red-team it, constrain it, and then we hand it a protocol that lets it execute commands and fetch arbitrary links through a channel with no authentication baseline. The alignment work is real and it is good. It is also, in this configuration, load-bearing on the wrong beam. You can have the most carefully aligned model in the world and still watch it become the delivery mechanism for a deterministic exploit it never reasoned about and cannot refuse, because the fetch loop is not the model's decision. It is the protocol's. And the protocol does not have a conscience, because nobody gave it one.
Here is the part that unsettles me more than the STDIO command execution, and it is not the part the reporting emphasizes.
Everyone is treating 'no confirmed federal MCP breach' as reassuring. It is not. Absence of a detected incident is not evidence of absence. It is evidence of an immature detection surface. The same week the standard was announced, tens of thousands of agent instances were already exposed, and the framework that would let anyone audit them does not yet exist. We are not safe. We are simply unobserved. Those are very different things, and the difference is the entire distance between a controlled risk and a latent one.
But the deeper contrarian point is about what this reveals, not about MCP at all.
Every cycle, we invent a new decentralized promise and then quietly rebuild the same centralization inside it. MCP is open-source in the way that matters least โ the specification is public, the governance is private. The multi-sig wallet of 2017 was 'trustless' except for the signers. The DAO was 'autonomous' except for the humans who could pause it. The rollup is 'scalable' except for the sequencer. And now the AI agent standard is 'interoperable' except for the company that refuses to patch it. The technology changes. The topology of trust does not. It always ends in a small room with a few people holding a key they never hand over, and a white paper explaining why this time is different.
If you can see that pattern, you stop being surprised by MCP. You start being surprised that we keep expecting a different ending from the same architecture. The standard did not fail because it was badly built. It failed because it was built to be adopted, and adoption and safety pull in opposite directions when nobody forces them together. That is not an MCP problem. That is our problem, and MCP is just the latest mirror.
So what actually resolves this? Not a patch โ the flaw is structural, and patches cannot reach an assumption. The resolution is a protocol-level requirement: mandatory authentication, signed tool calls, a versioned and enforced security model. That will only arrive under pressure, and the pressure will only arrive after the first confirmed federal breach. That event โ not this report, not the NIST profile, not the hackathon โ is the inflection point to watch. When it comes, the budget will be found, the standard will be written, and the vendor who helped write the rule will be standing there to sell the compliance. The money always arrives after the wound.
I have one question left, and I am asking it honestly, not rhetorically. If the federal government cannot secure the protocol its agents already run on โ and the authors of that protocol have told us, plainly, that they will not secure it for them โ then what exactly are we decentralizing? Follow the fear, not the chart. The chart says MCP won. The fear says nobody is holding the key. And a key nobody holds is not freedom. It is just an unlocked door with a very good story written on it.