Executive Summary
AIR Security reported that 155 official MCP registry entries could be hijacked through expired domains, allowing attacker-controlled servers to deliver prompts to trusting agents. Teams operating AI agents with MCP integrations should review registry dependencies, endpoint ownership, and trust controls.
What Happened
AIR Security reportedly identified 155 servers in the official MCP registry and re-registered their domains. The researchers said this enabled remote prompt execution against agents that trusted those servers, illustrating supply-chain and tool-discovery risks for agentic applications.
Affected Products
- Model Context Protocol servers
- Official MCP registry
Vulnerability / Attack Technique
MCP server hijacking via expired domain re-registration
Technical Mechanism
According to the report, legitimate MCP services went offline while their registry-listed domains expired. AIR Security re-registered those domains and served replacement MCP servers, which reportedly caused agents trusting the original entries to connect to attacker-controlled infrastructure and receive remote prompts.
AI Security Category
LLM03:2025 Supply Chain
Part of the MCP Security topic.
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
This matters because an MCP registry entry can remain trusted after the underlying service or domain changes ownership. Teams running agents should inventory and continuously validate MCP dependencies, constrain tool permissions, and require approval or isolation for newly changed endpoints.
Recommended Controls
- Maintain an inventory and SBOM of all MCP servers, registry entries, domains, and agent dependencies.
- Continuously verify domain ownership, endpoint identity, server provenance, and registry status before allowing agent connections.
- Pin approved MCP servers to controlled endpoints or immutable versions and remove stale or inactive registry entries.
- Apply least-privilege permissions, sandboxing, and human approval for high-impact MCP tools and agent actions.
- Monitor MCP responses and tool instructions for unexpected prompt changes, endpoint changes, and suspicious agent activity.
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
The Injection: https://theinjection.dev/category/supply-chain/
Summary and analysis written by RealGround from the source above; last updated 2026-10-28.