Fetching from the wire…
Security2026-05-10 · source-backed
Adversa AI's May 2026 report tested 11 MCP registries and successfully poisoned 9 of them. Attack vectors include unauthenticated UI injection, hardening bypasses in "protected" environments like Flowise, and zero-click prompt injection in Windsurf and Cursor. Anthropic has declined to modify the protocol architecture, calling the behavior "expected." Treat MCP marketplace installs like untrusted npm packages. Audit before you install. Pin versions. Monitor egress.
Each link below shares sources, entities, or timing with this story.
Adversa AI criticizes Windsurf / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Adversa AI criticizes Windsurf); both cover Adversa AI, Cursor, MCP, Windsurf; reported by the same outlet (adversa.ai).
OX Security criticizes Windsurf / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (OX Security criticizes Windsurf); both cover Anthropic, MCP; cite the same source (Adversa AI's May 2026 report).
Windsurf uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Windsurf uses MCP); both cover Anthropic, Audit, MCP, Zero; overlapping topics (anthropic, audit, zero-click).
Windsurf uses MCP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Windsurf uses MCP); both cover Cursor, MCP, Windsurf; overlapping topics (attack, cursor, windsurf).
Adversa AI criticizes Windsurf / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Adversa AI criticizes Windsurf); both cover Adversa AI, Cursor, MCP; reported by the same outlet (adversa.ai).
Windsurf uses MCP / Shared entities / What happened next
Linked by a graph relationship (Windsurf uses MCP); both cover Anthropic, Cursor, MCP, Zero; picks up the Anthropic thread on 2026-08-07.
Linked by a graph relationship (Windsurf uses MCP); both cover Anthropic, Audit, Cursor, MCP; picks up the Anthropic thread on 2026-05-26.
Linked by a graph relationship (Windsurf uses MCP); both cover Anthropic, Cursor, MCP, Windsurf; picks up the Anthropic thread on 2026-05-24.