Anthropic's MCP standard took over every AI agent in a year. Security wasn't ready.

Anthropic's open standard for connecting AI agents to outside tools and data, Model Context Protocol (MCP), was launched in November 2024 as a niche plumbing project. Within roughly twelve months it had become the default connector for every major AI assistant, coding tool, and agent on the market. By December 2025, more than 10,000 active public MCP servers were running across AWS, Google Cloud, and Azure, and ChatGPT, Gemini, Microsoft Copilot, Cursor, and Visual Studio Code all routed through it. The same speed that made MCP the universal connector also made it the fastest-growing piece of attack surface defenders now have to cover.

The threats are AI-native. Older firewalls were built to defend networks from conventional attacks: port scans, malware, credential theft, denial-of-service traffic, the kind that looks the same whether or not an AI is in the loop. MCP traffic does not. It carries instructions to a model, tool calls back out, and data the model is allowed to see. The attacks look like valid model input: prompt injection (instructions hidden in documents or web pages the model reads), data leakage (the model being tricked into exfiltrating connected files or credentials), and tool misuse (the model being steered to call connected tools in ways the user did not intend). A network firewall that watches for malicious IP addresses or unusual ports cannot see any of this. The model is the new endpoint, and the protocol is the new surface.

A new category of products is being marketed to fill the gap, sold as "AI firewalls," but the term is doing double duty in a way that makes buying decisions harder. For more than a decade, "AI firewall" has meant an AI-powered network firewall: a normal next-generation firewall that uses machine learning to spot intrusions. The newer meaning, which has started to show up in 2026 product launches, is a firewall built specifically to defend AI models, agents, and the tools they connect to from AI-native threats. The first public product in that newer category is Check Point's AI Network Firewall, released in July 2026, aimed at prompt injection, data leakage, and tool misuse rather than the network traffic around the model. The two products solve different problems; the marketing language does not always make that clear.

MCP moved from open standard to default connector in roughly a year, a speed that outpaced what traditional security review cycles and formal certifications can absorb. Every new MCP server added by an enterprise is a new tool, with its own permissions, data access, and instructions, sitting between a model and a sensitive system, and most of those servers are being deployed without the authentication, signing, and sandboxing that took years to mature for the web. The category is being defined in production rather than in specifications, and the products aimed at it are arriving after the deployments, not before.

The questions to ask any vendor using the "AI firewall" label are therefore narrow. Which of the two meanings is on offer: AI-powered network defense, or AI-native defense for models, agents, and the tools they touch? What MCP traffic does the product actually inspect, and at what layer: the network connection, the protocol messages, or the model calls and tool responses? How does it handle prompt injection and data leakage specifically, and what is its false-positive rate on legitimate agent behavior? And, the hardest one, does any protocol-native security (authentication, signing, or sandboxing baked into MCP itself) exist, and where does this product sit relative to that work? If the answer is that the protocol itself is still in the early phase of being hardened, the gap is wider than the trade press's headline numbers suggest, and the buying decision is really a bet on which vendor is closest to where the standard ends up.

The deployment count is still moving. Anthropic reported 10,000+ active public MCP servers in December 2025; the next milestone is whichever cloud provider or major agent platform publishes a public count next. That is also the moment the security stack will be tested at scale rather than in vendor demos.