Breach anatomy
What actually broke, traced to the control that was missing
Each entry is a published vulnerability or incident in how an agent system was authorized, written from its advisory. It names the class of failure, the requirements in the MCP auth atlas that stand for the missing control, and how many listed servers meet them today. Where the explorer has a toggle for the pattern, the entry links to that replay. Nothing here goes beyond what the advisory states.
- Entries
- 5
- With a replay
- 3
- Requirements named
- 3
Stolen OAuth tokens of an AI chat agent used to export Salesforce data
Salesloft Drift integrations with Salesforce and, for a few accounts, Google Workspace
No atlas requirement covers this control yet
Authorization endpoint from untrusted metadata run as a command
mcp-remote 0.0.5 to 0.1.15
All endpoints served over HTTPS Authorization serverReplay: Authorization endpoint taken from untrusted metadataAttack
One tenant's MCP server answered with another tenant's data
Asana MCP server (beta), 1 May to 4 June 2025
No atlas requirement covers this control yet
Authorization codes sent to an unchecked redirect URI
@cloudflare/workers-oauth-provider before 0.0.5
No atlas requirement covers this control yetReplay: Redirect URI not checked at authorizationMisconfiguration
PKCE verification skipped at the token endpoint
@cloudflare/workers-oauth-provider before 0.0.5
PKCE with S256 advertised Authorization server, PKCE on every authorization request ClientReplay: PKCE verifier not checkedMisconfiguration