CloudBolt says more than 20 percent of the MCP access policies it reviewed were broken or missing

Yasmin Rajabi, chief operating officer at CloudBolt, wrote in a guest piece on The New Stack today that after setting up MCP integrations across customer and prospect environments over the past several months, her team found "more than 20 percent" of the MCP-related access policies it reviewed were "either broken or missing entirely." That figure comes from CloudBolt's own engagements, so read it as a self-reported field observation rather than an independent audit.

The article's stronger evidence is external, and it points in the same direction. On July 28, 2026, the maintainers of the Model Context Protocol shipped a specification update built around authorisation: issuer validation, issuer-bound client credentials, and Client ID Metadata Documents as the preferred way for clients to register. Rajabi reads that as the protocol's own stewards admitting that the original trust model did not survive contact with production.

Three failure modes with real numbers behind them

Tool descriptions can be attack surface. In May 2025, researchers at Invariant Labs showed that GitHub's own MCP server could be hijacked through a poisoned public issue: an attacker's text in the issue body was read as an instruction by the agent and used the victim's token to pull data from private repositories. A 2026 benchmark called MCPTox then tested this pattern against 45 live MCP servers and 20 models, reporting a 36.5 percent average attack success rate and 72.8 percent against the worst-performing model, per the numbers Rajabi cites.

Scopes default to everything. Rajabi writes that 88 percent of MCP servers in the ecosystem require credentials to function but only 8.5 percent actually use OAuth, so most of what is running was never scoped in the first place. The article does not attribute those specific figures to a named external dataset, so treat them as her characterisation until you can find the underlying source.

Static tokens do not rotate, and nobody watches that they do not rotate. Splunk's own MCP Server app logged session and auth tokens in clear text until it was patched in version 1.0.3, tracked as CVE-2026-20205. Rajabi adds an estimate that over half of MCP servers in the wild run on static API keys or personal access tokens that are rarely rotated, and that close to half of enterprise AI activity runs through personal accounts rather than service accounts, again without an outside citation.

The decision Rajabi frames for platform teams

The article's landing is a concrete question: do you find out what a given MCP server can touch from an inventory you built on purpose, or from an incident report after the fact. The path she is arguing against is a formal change-review board, which she says is the same bureaucracy that made people bypass procurement in the first place. The path she is arguing for is inventory, token rotation, and per-server scope, applied to whatever the weekend project turned out to be.

Source

Researchers found that 1 in 5 MCP access policies came back broken or missing by Yasmin Rajabi on The New Stack, 10 September 2026.