Digest: MCP filesystem leaks, Copilot RCE and agent guard gaps

A scan of 21,097 MCP servers found 787 (16.4%) with filesystem access beyond their declared scope, 150 confirmed vulnerable instances and 13 advisories, including two CVEs in Anthropic's Git MCP Server. In Visual Studio Copilot and SSMS, indirect prompt injection plus a path-validation flaw led to remote code execution (CVE-2026-103572). The INFUSE benchmark across ~41,800 trajectories measured 19.6% average attack success.

• 787 of 4,806 triaged MCP servers (16.4%) had filesystem capability outside declared scope
• 150 instances dynamically confirmed vulnerable; 13 security advisories published
• INFUSE: 19.6% attack success; prompt hardening cut it from 58.2% to 14.3%
• Smaller guard models shift verdicts based on the instruction language