An audit found no login on 380 of 414 tested AI tool servers
The researcher found no sign of attacks, but 193 of 464 servers from one test run were gone three days after.
On 31 July 2026, researcher Nicolás Padilla published a preprint, a paper that other experts did not check. It is about servers that use the Model Context Protocol (MCP), which lets an AI agent use tools on other computers. He found 640 live servers on the internet and tested 414. Of these, 380 (91.8%) had no OAuth, a standard login check. The tests found 68 faults to report.
How it works
Padilla found servers in 11 public sources. He then used a test tool that he made, Corvus, with 34 test modules. He made four test runs in July 2026. He did not get credentials or remove data.
The numbers
- 687 tools offered shell commands with no access control.
- 193 of 464 servers were gone after three days (41.6%).
- 38 servers had command injection, which lets an attacker operate commands.
Padilla reports no sign that an attacker used a fault.
What is not known
The paper has one author and no peer check. The tests used only servers that all persons could reach. Thus the figures do not include all MCP servers. The paper gives the 687 figure in two different forms. It does not tell how many maintainers answered.
Insight: Agent tool connections grow faster than owners make them safe
BeyondTrust says 85% of the coding agent users that it saw had an MCP server. This audit found 380 of 414 exposed MCP servers with no OAuth, and 193 of 464 gone after three days. This reads as a distance between how fast companies add agent tool connections and how fast they count and make them safe. Vendors of agent controls can sell into it. Tell your teams to find the owner of each connection.
Sources
Posted
