MCP servers are emerging as privileged middlemen for AI agents, and researchers say that model context protocol (MCP) setups can leak enterprise secrets through plaintext configs, over-permissioned access, and prompt injection. The concrete flaw is CVE-2025-6514 in mcp-remote, where a malformed server connection can trigger OS command injection on the client side.
The risk is bigger than one bad connector. MCP helpers often carry real credentials and tokens for cloud, docs, APIs, and internal tools, so if the bridge is misconfigured or exploited, an attacker can reach both commands and the keys the bridge was meant to protect. That makes the connector layer part of the trust boundary, not a harmless plugin, for any team running AI agents against live systems.