Model Context Protocol (MCP) is an open standard that enables LLMs to integrate and interact with external data sources and tools. This protocol extends LLM capabilities beyond information generation, allowing them to execute complex, automated tasks across multiple services—including managing GitHub repositories, accessing Notion databases, handling Zendesk tickets, and querying PostgreSQL databases. While MCP significantly enhances LLM utility by enabling interoperability with an expanding ecosystem of services, awareness of associated security risks remains limited. The protocol's inherent complexity creates an extensive attack surface that can be exploited without requiring advanced technical skills. In this presentation, I will demonstrate practical exploitations using real-world services including GitHub, Notion, Zendesk and PostgreSQL connected via MCP. These attacks represent just a subset of possible exploitation techniques, as the attack surface expands with each new MCP integration. I will show how a single malicious GitHub issue can lead to persistent code injection, how innocent-looking support tickets can expose entire technical architectures, and how accidentally installing a malicious server can cause critical misclassification during vulnerability triage—leading security teams to deprioritize genuine threats while focusing on false positives. The demonstrations include multi-service attack chains that reflect common enterprise MCP deployments. Finally, I will present comprehensive mitigation strategies focusing on MCP-specific measures such as malicious server scanning, MCP communication monitoring, while emphasizing the continued importance of traditional security practices like least-privilege access configurations. Although many MCP-specific security tools have emerged, I will demonstrate their limitations and introduce more robust scanning approaches that address fundamental security gaps. This practical guidance will help developers and security professionals proactively secure their MCP deployments. As LLMs evolve from passive assistants to active system orchestrators, we must urgently adapt our security models to address this new and powerful attack surface. Yusuke Nakajima