The Lethal Trifecta: MCP's Security Reckoning

The flip side of a universal connector is a universal attack surface. Colin and Christian dig into the security reckoning of the MCP era: tool poisoning attacks that hide instructions where users can't see them, benchmark studies showing top agents fooled more than 60% of the time, audits finding 40% of MCP servers running with no authentication at all — and Simon Willison's "lethal trifecta," the three-ingredient combination that makes most production agents exploitable by design. Then the practical part: the defense-in-depth playbook that separates a deployable agent from a security incident waiting to happen.