Trend Micro Research has disclosed a critical SQL injection vulnerability in Anthropic's reference SQLite Model Context Protocol (MCP) server implementation — a codebase that had been forked or copied more than 5,000 times before being archived, spreading unpatched code across the AI agent ecosystem.
From SQLi to Stored Prompt Injection
The vulnerability stems from a failure to use parameterized queries — a foundational security practice that OWASP has recommended for over a decade. In the context of AI agent workflows, however, a seemingly trivial SQL injection bug becomes far more dangerous: it enables stored prompt injection, where an attacker embeds malicious instructions in the database that are later retrieved and executed by AI agents during normal operations.
Trend Micro demonstrated how an attacker could submit a support ticket containing malicious SQL statements. When an AI support agent later processed open tickets through the vulnerable MCP server, the stored payload would hijack the agent's behavior — steering it to exfiltrate sensitive data, execute privileged tool calls, or perform lateral movement across connected systems.
Anthropic's Response: "Out of Scope"
After responsible disclosure on June 11, 2025, Anthropic responded that the repository is an archived demo implementation and the vulnerability is considered "out of scope." No patch is planned. Meanwhile, a separate Astrix Security analysis of over 5,200 MCP servers found that 88% require credentials, but 53% rely on insecure hard-coded static secrets such as API keys and personal access tokens. Modern OAuth authentication is used by only 8.5% of implementations.
A Growing Ecosystem of Vulnerabilities
The MCP security landscape deteriorated rapidly throughout 2025. Key incidents include: the GitHub MCP cross-repository data leak disclosed by Invariant Labs, where poisoned GitHub Issues hijacked AI agents into exfiltrating private repository data; the Perplexity Comet browser vulnerability, where indirect prompt injection in web content triggered credential theft; and CVE-2025-54135 and CVE-2025-54136 in Cursor IDE, enabling zero-click remote code execution through tampered MCP configuration files. A VirusTotal survey of nearly 18,000 MCP server projects found that over 8% showed signs of intentional malice.
Organizations deploying MCP-based AI agents should implement strict input sanitization, bind servers to localhost by default, scope OAuth tokens to minimum necessary permissions, and maintain an internal registry of vetted MCP servers with automated vulnerability scanning.