MCP and AI Tool Connections: The Risks of Plugging an AI Assistant Into Your Accounts

What MCP is, and why it matters

AI assistants are more useful when they can read your documents, search your email or update a spreadsheet. The Model Context Protocol (MCP) is a standard way to connect an assistant to those tools and data. Each connection, often called a server or connector, gives the assistant a new ability. It also gives an attacker a new place to aim.

The risk is easy to underrate because setup is quick. A tool you add in a minute may run code on your computer or hold a token that lets it act in your accounts.

What the MCP security guidance warns about

The protocol’s own security best practices page lists attacks that implementers need to guard against. Four matter most to ordinary users.

Local server compromise. Local MCP servers run on your machine. The guidance says they may have direct access to your system, and lists risks such as arbitrary code execution, no visibility into what commands are run, command obfuscation, data exfiltration and data loss. Its example of a malicious startup command shows how a harmless-looking install line can also send your private files elsewhere. It says clients offering one-click setup must show the exact command and get explicit approval first.

Confused deputy. In some designs an MCP proxy server connects to third-party services. The guidance explains how an attacker could exploit consent shortcuts to obtain access without the user’s real approval, and requires per-client consent screens.

Token passthrough. Passing a token on without checking it was issued for that server is forbidden in the guidance, because it can bypass security controls and make audits harder.

Session hijacking. If someone obtains a session ID, they may inject events or impersonate a user. The guidance says servers must verify all inbound requests and not use sessions for authentication.

Most of these are duties for developers. As a user, you cannot inspect tokens. What you can do is choose carefully who you trust.

Too much access is the multiplier

The guidance also warns about broad permissions. It describes how a stolen token carrying wide scopes, such as access to all files, expands the damage, and recommends progressive, least-privilege scopes. The same idea applies to you: a connector that can read one folder is a smaller problem than one with your whole drive and mailbox.

Where prompt injection comes in

An MCP connection joins two weaknesses. The assistant can be fooled by text it reads, and it can now take actions. The UK NCSC says that if an AI’s output triggers tool or API calls, a successful prompt injection can give an attacker the same access as those tools. Its rule of thumb is that when an AI processes information from a party, its privileges should drop to that of the party. An assistant reading an unknown email should not also hold a tool that can send money or delete files. Read more in our prompt injection explainer.

Supply chain: who built the server?

OWASP’s LLM03:2025 entry covers weaknesses in the components AI systems rely on. It points to weak provenance, where attackers can compromise a supplier’s account or create a lookalike repository, and vulnerable or outdated components. The same logic applies to connectors. A tool with a convincing name from an unknown author deserves the suspicion you would give a fake AI app or browser extension.

A safer routine

Add connections one at a time, from publishers you can name. Prefer read-only access. Keep confirmation on for anything that sends, deletes or buys. Review and remove old connections. Our guide to AI agent permissions and risks goes deeper on what to allow. If something misbehaves, disconnect it, revoke its access in the connected account, change passwords, and follow the data breach checklist.

This article reflects public information as of 2026-11-06. AI tools and rules change quickly; we update articles when new facts are published. Spot an error? See our editorial and corrections policy.