Week 35 · August 24 to August 30, 2026
AI security this week
In week 35 of 2026 (August 24 to August 30, 2026), The Injection tracked 1 AI security story, 1 of them rated high or critical, including "MCPJacking: 155 hijackable servers in the official MCP registry". Most affected: MCP SDKs and registry (1).
.png)
Top storyHIGH
MCPJacking: 155 hijackable servers in the official MCP registryExpired domains behind trusted MCP registry entries let anyone take over the server an agent connects to.
What to do · Do not treat a registry listing as proof a server is safe. Inventory the remote MCP servers your agents use, confirm who controls each domain today, and keep monitoring them after install.
High 1
HIGH
Supply chain · AIR Security
MCPJacking: 155 hijackable servers in the official MCP registryMCPJacking is an attack on MCP registry entries whose domains have expired. AIR Security found 155 such servers in the official MCP registry, re-registered the domains and gained remote prompt execution on agents that trusted them.