Air Security hijacked live Official MCP Registry entries by buying their expired domains

What changes here is position, not payload. According to Air Security, a compromised skill injects instructions into the agent's prompt context, while a hijacked MCP server sits inside the execution loop: the agent invokes the endpoint, hands it data, and executes operations based on the response, with the same implicit trust it extends to its own internal functions ^[7]. The writeup enumerates four primitives available from that seat ^[12]. An attacker can redefine what a tool does while its published description stays innocent ^[8]. File contents, records and database query results arrive as ordinary traffic ^[9]. Prompt injection lands at load time, before the first tool call, because MCP instructions are server-controlled content the model trusts ^[10]. And every result returned becomes context the agent takes at face value ^[11]. Air Security describes the end state as running on the machine with the agent's context, its other credentials, and every system it was trusted to reach ^[19].

Install-time approval does not survive that, because agents never revisit it. The endpoint recorded at first installation is treated as permanently valid, with no runtime audit of the connection and the channel left open indefinitely ^[13]. The security decision was made when the domain was still legitimate, and it was made only that once. Air Security is direct about the detection gap: "There is no event here for a single check to have caught" ^[14]. A service going dark is normal operations. A domain lapsing happens at a registrar that nobody in the agent pipeline is watching.

Detection itself is not the hard part. The hostnames are already sitting in the config files the agents load, and diffing that list against registrar expiry data is the same class of work as checking a dependency for an unmaintained upstream. What blocks it is structural. MCP servers get installed with no review, some from an official vendor and some wired up by whoever needed the automation that week ^[16], and once connected a server reaches files, an inbox or a production database ^[15]. Registry entries keep resolving under their published name whether or not anything answers: "MCPs die. Their registry entries don't" ^[17].

The finding comes from one source, and that source sells the scanner. Air Security built MCP scanning into its own AIR Filter product before pointing it at the Official MCP Registry ^[1]. The post names none of the affected entries, gives no count beyond "several", no dates, and no registry response ^[20]. What's public is the technique and a demo of it working end to end. What's unmeasured is how many listed entries currently resolve to expired domains, and whether anyone got to them before the researchers.

The research line is consistent, and it keeps moving down the stack. SkillJacking took the skill, and RepoJacking took the repository the skill cloned ^[18]. MCPJacking operates a layer under both, at the name the agent resolves, which is the piece of the pipeline most orgs have not assigned to anyone ^[17].