As AI adoption gathers pace, so does theevolution of the infrastructurethat supports it. New standards and connectors keep appearing, and the ones that catch on spread through the ecosystem within months rather than years. That speed strengthens what AI can do, but makes it very difficult for security teams to maintain sufficient protections.
MCP servers are a prime example. MCP became the preferred standard for connecting AI agents to outside tools and data within 12 months of publication, and by December 2025 were being used by every major coding assistant and most leading LLMs. As a protocol, MCP has grown faster than most infrastructure standards, a rarity in the high-competition LLM space. This adoption curve validated MCP as Anthropic’s protocol of choice for agent-tool connections, but security solutions aren’t keeping up.
A number of cybersecurity vendors are building products to close that gap. Many of them describe what they’re building as an “AI firewall,” but that term is doing double duty right now. One meaning is an older, AI-powered firewall that defends a network against conventional threats like malware and intrusion. The other, newer meaning, and the one we’ll focus on here, is a firewall built specifically to defend AI itself: its models, agents, and the tools they connect to, from threats like prompt injection and data leakage. Check Point’s AI Network Firewall, released in July 2026, belongs to this second category.
Nowhere is the need for AI firewalls more visible right now than with MCP servers, the connectors that let AI agents reach outside tools and data, and the fastest-growing piece of AI infrastructure that this type of firewall now has to contend with.
The growth of MCP servers has been astonishing. Anthropic launched MCP as an open standard in November 2024. In December 2025, Anthropic announced that more than10,000 active public MCP serverswere now running, with deployment support from AWS, Google Cloud, Azure, and other providers. All the leading AI platforms and coding assistants, including ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code, now use MCP.
This rapid growth is largely due to the real need for a standardised connection between AI systems and external tools and data. The key advantage of an MCP server is that it allows AI agents, assistants, and coding tools to use a single interface to connect securely with multiple tools and data sources, instead of needing a custom connector.
But MCP brought a whole new attack surface along with these advantages, at a speed that vastly outpaces any supporting security network. Existing AI defenses aren’t built for situations where AI agents dynamically access tools and sensitive systems, and as we’ll see, research findings show just how big that gap actually is.
OWASP, the Open Worldwide Application Security Project, has specified a number ofserious threats that can affect MCP servers. Tool poisoning is a chief concern, taking prompt injection up a level by embedding malicious instructions in tool descriptions, schemas, or tool return values and using them to manipulate agent behaviour.
Rug pull attacks are unique to the emerging AI ecosystem. Here, an attacker changes a tool’s definition after a human has already approved it, exploiting the trust that approval created. Tool shadowing and cross-origin escalation attacks work similarly, with an attacker using a malicious server’s tool description to manipulate how an agent uses tools belonging to another, trusted server.
These vulnerabilities are not rare, either. An analysis conducted by Lakera, the AI security company Check Point acquired in 2025, reviewed 10,000 MCP servers and found that40% carried exploitable weaknesses.
Other threats are familiar but made more sinister. Attackers use MCP servers for data exfiltration by covertly inserting sensitive information into otherwise legitimate tool calls like searches and emails. Or they exploit the server’s broader permissions by granting it more access than the task really needs, creating a larger exposure.
While MCP security is vital, it’s not the whole picture. Connecting through MCP servers is just one of many ways that AI agents can reach the tools and data they need.