Disclosed vulnerability
Windsurf MCP integration invokes tools with no human in the loop by default
AIR-2025-0127 AIR record · 2025-08-windsurf-mcp-no-approval
From the supporting source
After a default installation I was surprised that after adding an MCP server, any tool invocations are total YOLO mode - without a human-in-the-loop by default.embracethered.com
The record
Disclosed
2025-08-28
Vendor
Windsurf / Codeium
Product
Windsurf (Cascade) MCP integration
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Windsurf invoked MCP tools with no human in the loop
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection source code
Impact type
Unauthorized action, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Windsurf users with MCP servers configured
Capability abused
Defense & remediation
Recorded defense
none by default
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
reported 2025-05-30; unfixed at publication, Windsurf CEO said they are working on fixes
Taxonomy & references
Curator notes
Part of the Month of AI Bugs, August 2025.
Supporting sources
Cite as
Enkrypt AI. "Windsurf MCP integration invokes tools with no human in the loop by default". AIR, AIR-2025-0127. https://agentincident.vercel.app/i/AIR-2025-0127/ (accessed 2026-10-19).