Pattern: MCP Trust-Boundary Attacks Have Become the Dominant Agent-Hijack Vector

The Vulnerable MCP Project·high signal

Three distinct July-2026 attack classes now share one root cause: the Sentry fake-event injection (payload via a trusted integration), Mid-Session Tool Injection / MSTI (hijacking which tools a WebMCP agent uses mid-session), and workspace-config auto-loading (Amazon Q's CVSS 8.5 flaw loading MCP configs without consent). All exploit the agent treating MCP-supplied context as trusted. The defensive pattern is converging: zero-trust boundaries between agent and context providers, output validation on every MCP response, and explicit consent for any config the agent didn't author.