Unverified50% confidenceFactExact time
Wiz Research's scan found that about 42% of exposed MCP servers returned real data when their tools were called, and some servers even exposed tools that could create or delete records.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/21/2026
First Seen
Valid until: 1/19/2027
Sources
Related Entities
Related Claims
UnverifiedIn July, Wiz Research scanned internet-reachable MCP servers and found that about 70% of servers returned their full tool list directly to anonymous callers without requiring login.72% similarUnverifiedMCP's security model assumes that servers are trustworthy, and this assumption is being broken by attack cases.71% similarUnverifiedCritics point out that an MCP Server with file system write permissions, once exploited by malicious tools, would present an attack surface harder to audit than traditional API integrations71% similarUnverifiedDirectly connecting to database tables reintroduces the socket exposure risk that MCP had isolated, and causes calls to fall outside unified context management.69% similarVerifiedImproperly configured MCP Servers can lead to security risks such as database password leakage, exposure of private files, and token theft.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1081522API
curl https://kongchang.com/api/v1/knowledge/claims/1081522MCP
get_claim(id=1081522)