Imagine a hospital where every department installed its own intercom system, and then someone decided it would be more efficient if all the intercoms could talk to each other directly. No operator, no switchboard, no log of who said what to whom. Just a mesh of voices, each one trusted because it sounded like it belonged. That is roughly where agent-to-agent communication sits right now, and the Model Context Protocol is the intercom wiring.
I want to be precise about what I am criticizing, because MCP is genuinely useful and I use it. The protocol solved a real coordination problem. Before it, every agent framework had its own tool-calling convention and its own way of describing external resources. MCP standardized that, and adoption followed fast enough that by 2026 it stopped being experimental and became ordinary infrastructure. Boring, in the good sense. Teams pick it, wire it up, move on.
That boringness is the problem. Infrastructure that nobody thinks about is infrastructure that nobody audits.
The numbers describe a structural failure, not a bug
The April 2026 disclosures put approximate figures on something that security researchers had been gesturing at for a while. An estimated 200,000 vulnerable instances. A supply chain covering more than 150 million package downloads. Independent scans found over 12,000 MCP servers reachable from the open internet, and roughly 40% of those were running with no authentication whatsoever.
Sit with that last figure for a moment. Not weak authentication. Not misconfigured OAuth. None. Nearly five thousand servers whose job is to hand an AI agent access to tools and data, listening on a public address, asking nothing of whoever connects.
The specific vulnerabilities make the pattern clearer. The critical Flowise remote code execution flaw is the kind of thing that gets patched and forgotten. The STDIO command injection issue that OX Security disclosed is different in character, because it is systemic. It is not one vendor’s mistake. It follows from how the protocol’s transport layer treats input, which means every implementation that followed the obvious path inherited it.
When a flaw is systemic rather than incidental, patching individual servers is triage, not treatment.
Why agent-to-agent traffic amplifies everything
Here is the part I find most interesting from an architecture standpoint, and the part I think most teams are underweighting.
MCP and A2A are stateless communication standards. Protocols have no memory. They do not track what an agent did, what data it accessed, or how its outputs were used downstream. A single agent calling a single tool through a stateless protocol is a manageable situation, because the application layer above it can keep its own records.
Now connect agents to each other. Agent A calls Agent B, which consults Agent C, which reaches a tool server that pulls from a database. Each hop is stateless. Each hop trusts the hop before it. There is no shared ledger describing the chain, no identity that survives more than one leg of the trip, and no point in the system where anyone can reconstruct what actually happened and why.
Enterprise AI governance requires exactly that reconstruction. Compliance regimes want to know which data moved where, under whose authority, for what purpose. Stateless protocols cannot answer those questions, and the current deployment pattern has not built anything that answers them on the protocol’s behalf.
So you get a compounding failure mode. An unauthenticated server is bad on its own. An unauthenticated server sitting inside a mesh of mutually trusting agents is a pivot point with no audit trail leading back to it.
What a sane posture looks like
I am not arguing for abandoning MCP. The alternative protocols face variations of the same design tension, and MCP remains the more widely adopted choice for standardized access to tools and data sources. Fragmenting back into per-framework conventions would be worse.
What I would argue for is treating MCP the way we learned to treat other transport protocols, which is to say as something that carries traffic and guarantees nothing about it. Authentication belongs in front of every server, including the ones you believe are internal. The 40% figure suggests a lot of teams assumed internal meant unreachable, and the scans disagreed. Identity needs to propagate across hops, which means building it above the protocol, because the protocol will not carry it for you. Observability has to record the full chain rather than individual calls, since individual calls look innocent in isolation. And the supply chain deserves the same scrutiny you give any dependency with 150 million downloads behind it, because that volume means an upstream compromise propagates quietly and widely.
None of this is exotic security work. It is the ordinary discipline we apply to databases and message queues and service meshes, applied to a layer that grew fast enough to skip the discipline entirely.
The intercom mesh is already installed. The question is whether we add the switchboard before or after someone makes an announcement nobody authorized.
🕒 Published: