The Model Context Protocol specification requires authorization servers to validate exact redirect URIs, but it leaves practical implementation policies up to individual operators. When servers accept arbitrary redirect addresses to accommodate custom tools, attackers can register malicious links under trusted names like "Claude." Users then unwittingly approve legitimate consent prompts that route their authorization codes directly to malicious domains. Recent incidents have demonstrated that this vulnerability exposes critical business records, merchant profiles, and banking details.
Key points
Platforms like GitHub and Atlassian lock out independent developers unless server adminis…: Platforms like GitHub and Atlassian lock out independent developers unless server administrators manually update configuration files to permit custom redirect URIs.
Accepting unvalidated redirect addresses turns Model Context Protocol servers into open r…: Accepting unvalidated redirect addresses turns Model Context Protocol servers into open redirectors under RFC 9700 and compromises single sign-on proxies.
Attackers can siphon long-term access tokens from signed-in users without needing to bypa…: Attackers can siphon long-term access tokens from signed-in users without needing to bypass security mechanisms like PKCE.
Sources checked by our analysis pipeline: 1
The problem
You run your own agent: a Slack bot, a service on a VPS, an MCP client you wrote over a weekend. You want it on your files, which on Stream Vessel means your own S3 bucket, where an agent can read, write and delete through the MCP server. The agent speaks MCP’s standard OAuth sign-in: it registers itself, opens a browser, you click Approve, it gets a token.
It fails at step one. At registration the agent named its redirect URI, the address your browser returns to after you approve, carrying a one-time authorization code the agent swaps for a token. Yours is https://agent.yourhost.example/callback
; the answer is invalid_redirect_uri
. The server only accepts addresses on its operator’s allowlist: Claude, ChatGPT, Cursor, VS Code and a few others. Getting yours added means asking the operator to change a config file.
The server cannot simply accept any address. That list is the addresses the post office will deliver your house keys to. Without it, a stranger registers a fake “Claude” that has the keys sent to their place, and…
Industry supply chains are actively feeling the strain as the semiconductor sector prioritizes resources for artificial intelligence. According to leadership at Siltronic, this intense focus is redistributing components and limiting availability across diverse external sectors. Consequently, non-AI businesses face growing competition for essential silicon manufacturing capacity.
The tech giant's requirement has sparked major pushback from educators who worry integrated artificial intelligence features will erode independent student learning. Prominent lawmakers and regulators have strongly condemned the policy as anti-competitive extortion that leverages Google's dominant classroom hardware footprint. In response to the outcry, company officials attempted to clarify their deployment settings while defending the integration as a way to give districts more educational control.
Federal lawmakers are preparing aggressive oversight measures aimed directly at advanced artificial intelligence systems and the organizations building them. Under the contemplated