Developers are already under pressure to secure code, and now they also need to secure applications where AI agents can interact with tools, data, and external services.
A recent industry study found that roughly 40% of remote Model Context Protocol (MCP) servers expose their tools with no authentication. As organizations connect AI agents to more of their systems, those connections often aren’t properly secured.
SecureFlag’s new OWASP MCP Top 10 course helps developers build these security skills through hands-on practice, with real-world scenarios to find and fix MCP vulnerabilities.
What is the OWASP MCP Top 10?
The Open Web Application Security Project (OWASP) is a nonprofit dedicated to improving software security, producing widely used resources for the application security community.
The OWASP MCP Top 10 is one of its newer projects, focused on the risks facing applications built using MCP, the standard for connecting AI agents to tools, data, and other services.
An agent connected via MCP could have direct access to sensitive data and systems, so a flaw in how a server or client is built doesn’t stay contained. For example, an overly permissive agent could get access to resources it doesn’t need, or a compromised tool could manipulate an agent’s behavior.
What are the OWASP MCP Top 10 risks?
The OWASP MCP Top 10 ranks the security risks for MCP-based systems:
1. Token Mismanagement & Secret Exposure
Secrets can become exposed when credentials are hard-coded, or tokens aren’t properly protected. An attacker who gets hold of one of these secrets may be able to access services connected to the MCP application.
2. Privilege Escalation via Scope Creep
An agent may start with limited permissions but gradually gain access to more tools or resources than it needs. Permissions should be strictly scoped to prevent an agent from taking actions it wasn’t supposed to.
3. Tool Poisoning
An MCP tool shouldn’t automatically be trusted, as a compromised tool can manipulate what the agent receives and use that influence to change its behavior.
4. Software Supply Chain Attacks & Dependency Tampering
MCP applications rely on packages, dependencies, and other components that can become part of the attack surface. A compromised dependency or tampered component can introduce malicious behavior without developers realizing that anything has changed.
5. Command Injection & Execution
If an agent passes untrusted input into a command without properly validating it, an attacker may be able to influence what gets executed. This can potentially give them access to the host environment.
6. Intent Flow Subversion
Instructions hidden in content an agent processes can cause it to move away from its original task. An attacker can use this to steer the agent toward an action that benefits them instead.
7. Insufficient Authentication & Authorization
MCP servers and tools need to know who or what is requesting access and what they’re allowed to do. Without proper authentication and authorization, attackers may access tools or resources they shouldn’t.
8. Lack of Audit and Telemetry
When tool calls, context changes, and other agent activity aren’t properly logged, suspicious activity can be difficult to find and investigate. Logging MCP tool activity gives teams a much clearer picture when there’s an incident.
9. Shadow MCP Servers
MCP servers can be deployed without going through an organization’s usual security processes. It can leave security teams unaware of what an agent can access and make the deployment much harder to protect.
10. Context Injection & Over-Sharing
Agents often need access to information from multiple sources, but that information needs to be properly scoped. Poorly managed context can allow sensitive data to leak between users or tasks, or allow malicious content to influence another interaction.
Learn MCP Security Through Hands-On Practice
These MCP security risks are easier to understand when developers can see how they appear in real code and practice fixing them.
This course walks participants through each item on the OWASP MCP Top 10, pairing the concept with a hands-on lab. The labs put participants into realistic scenarios where they need to identify what’s going wrong and apply the proper fix.
Here are some of the lab topics covered:
-
Identify malicious instructions introduced through indirect prompt injection and prevent them from influencing the agent.
-
Find credentials exposed through an unencrypted agent connection and secure the communication.
-
Fix an MCP agent whose permissions have expanded beyond what it needs.
-
Investigate a compromised MCP tool and apply controls to reduce the risk of a backdoored tool.
-
Stop untrusted input from being turned into commands that give an agent access to the host system.
Build MCP Security Skills with SecureFlag
Developers need opportunities to practice identifying vulnerabilities and applying secure coding techniques in the kinds of scenarios they encounter when building agentic applications.
SecureFlag helps organizations build that practical security capability through hands-on labs that let developers learn by doing. Thousands of labs cover everything from established languages to the newest layers of the stack, such as MCP and agentic AI, giving teams a focused way to build security skills around the risks of giving AI agents access to tools, data, and systems.
