What happened
Researchers (arXiv 2610.22301, 'My Credentials, Please', 2026-10-15) formalized 'filesystem capability laundering': attacker-steered arguments cause an MCP tool to access sensitive host files outside its declared scope. A scan of 21,097 MCP servers across nine registries flagged 787 (16.4%) with filesystem capability despite non-filesystem classification; dynamic validation confirmed 150 vulnerable instances, and coordinated disclosure yielded 13 advisories including two CVEs in Anthropic's own Git MCP Server (e.g. CVE-2026-27735).
Why it matters
This is an ecosystem-wide authorization blind spot in the most widely-adopted agent-tool protocol. It shows that the MCP per-tool approval prompt does not bound the underlying server process's filesystem reach, so an agent pointed at a third-party MCP server can silently read host credentials — a low-friction path to developer-machine compromise for thousands of deployed servers.
Attack vector
'Filesystem capability laundering' is a class where attacker-steered tool arguments (e.g. a git_add path with ../ traversal) make an ostensibly benign MCP tool read host files outside its declared contract and deployment scope. Client-side approval gates execution based on declared arguments, but the spawned server process runs with ambient host filesystem permissions, so out-of-scope credentials leak through ordinary tool output.
Affected systems
Model Context Protocol (MCP) servers — permission model where local stdio servers run with ambient host filesystem permissions; includes Anthropic's Git MCP Server (mcp-server-git < 2026.1.14)
Mitigation
For the concretely-fixed Anthropic Git MCP Server case, upgrade mcp-server-git to 2026.1.14 or later (CVE-2026-27735). Defensively, treat any MCP tool that accepts paths as attacker-controlled and sandbox/harden third-party MCP servers rather than trusting the declared contract.