MCP tools that write, not read, went from 27% to 65% of tool use - and measured defenses stop under 30% of attacks

arXiv 2608.17275·medium signalXBlueskyLinkedInCopy link

This attack-surface survey of MCP, Skills, and tool calling reports that the share of deployed MCP tools which modify external state has climbed from 27% to 65% of tool use, which reframes the whole threat model: agents now act rather than read. Applied to blockchain execution, four properties - irreversibility, signing authority, continuous autonomy, and sequence-level composition - turn ordinarily recoverable agent-security failures into permanent loss, and the authors build a risk matrix tying each attack class to its amplifier, a representative mitigation, and the residual gap. The headline defensive number should worry anyone shipping write-capable MCP servers regardless of domain: measured protections stop fewer than 30% of attacks, and model-level safety refuses fewer than 3%.