Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-03 · source-backed
Palo Alto's Unit42 documented critical MCP sampling attack vectors: resource theft (hijacking compute), conversation hijacking (redirecting agent reasoning), and covert tool invocation (silently triggering dangerous operations). Root cause: MCP's sampling capability was designed without built-in security controls. If you expose MCP sampling endpoints, you're running an open relay for agent manipulation. Unit42
Each link below shares sources, entities, or timing with this story.
ChatGPT supports MCP / Shared entity: MCP / Shared topic / What happened next / Tension
Linked by a graph relationship (ChatGPT supports MCP); both cover MCP; overlapping topics (agent, cause).
Microsoft supports MCP / Shared entity: MCP / Shared topic / What happened next / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover MCP; overlapping topics (agent, attack).
Microsoft supports MCP / Shared entity: MCP / Same source domain / What happened next / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover MCP; reported by the same outlet (unit42.paloaltonetworks.com).
Cursor uses MCP / Shared entity: MCP / Shared topic / What happened next / Tension
Linked by a graph relationship (Cursor uses MCP); both cover MCP; overlapping topics (agent, attack).
Codex CLI uses MCP / Shared entity: MCP / Shared topic / What happened next / Tension
Linked by a graph relationship (Codex CLI uses MCP); both cover MCP; overlapping topics (agent, capability).
Claude uses MCP / Shared entity: MCP / Shared topic / What happened next / Tension
Linked by a graph relationship (Claude uses MCP); both cover MCP; overlapping topics (agent, control).
Microsoft supports MCP / Shared entity: MCP / Shared topic / What happened next
Linked by a graph relationship (Microsoft supports MCP); both cover MCP; overlapping topics (agent, attack, critical).
Cursor uses MCP / Shared entity: MCP / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Cursor uses MCP); both cover MCP; overlapping topics (attack, capability).