As is the article feels a bit light on details. I'm not surprised that there are open servers out there, but if you're writing an article about that, at least provide interesting details.

Here we go again.

Before we had seen (and there still) MongoDB databases exposed all over the internet with zero credentials protecting them. (you can just connect to them and you are in.)

Now we have exposed MCP servers waiting to be prompt injected and their data to be exfiltrated from say, a connected service or database if they are connected to any. [0]

So now you can just talk to anyone's exposed MCP server and ask for the secret passwords, environment variables and sensitive data.

And the AI will just hand it all over.

[0] https://news.ycombinator.com/item?id=44507024

In that case, limiting the remote IPs would also be useful. I haven't played around with MCP, but it's on my todo list.

That said, it’s still surprising (and a little funny) to see how fast these things end up public. Probably lots of default setups left running without realizing they’re wide open.