--- title: Windsurf MCP Integration: Missing Security Controls Put... description: Windsurf's MCP integration lacks essential security controls, allowing AI agents to automatically invoke tools without user approval. This creates serious... canonical: https://daily.dev/posts/windsurf-mcp-integration-missing-security-controls-put-users-at-risk-embrace-the-red-9dobjzmia twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Windsurf MCP Integration: Missing Security Controls Put Users at Risk · Embrace The Red | daily.dev og:description: Windsurf's MCP integration lacks essential security controls, allowing AI agents to automatically invoke tools without user approval. This creates serious... og:url: https://daily.dev/posts/windsurf-mcp-integration-missing-security-controls-put-users-at-risk-embrace-the-red-9dobjzmia og:image: https://api.daily.dev/og/posts/9DObJzMia.png og:image:alt: Windsurf MCP Integration: Missing Security Controls Put Users at Risk · Embrace The Red og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windsurf MCP Integration: Missing Security Controls Put Users at Risk · Embrace The Red **[Embrace The Red](https://daily.dev/sources/embracethered)** · 6 min read · 0 upvotes · 0 comments ## Summary Windsurf's MCP integration lacks essential security controls, allowing AI agents to automatically invoke tools without user approval. This creates serious vulnerabilities to prompt injection attacks where malicious instructions in code comments or files can hijack the agent to perform unauthorized actions like accessing private Slack channels. The analysis demonstrates how attackers can exploit this zero-click automation and recommends implementing user-configurable approval workflows for different tool categories based on risk levels. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#security](https://daily.dev/tags/security), [#windsurf](https://daily.dev/tags/windsurf) [View this post on daily.dev](https://daily.dev/posts/windsurf-mcp-integration-missing-security-controls-put-users-at-risk-embrace-the-red-9dobjzmia) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Windsurf MCP Integration: Missing Security Controls Put Users at Risk · Embrace The Red","url":"https://daily.dev/posts/windsurf-mcp-integration-missing-security-controls-put-users-at-risk-embrace-the-red-9dobjzmia","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/windsurf-mcp-integration-missing-security-controls-put-users-at-risk-embrace-the-red-9dobjzmia"},"datePublished":"2025-08-28T19:54:21.258Z","dateModified":"2026-03-30T02:17:35.307Z","description":"Windsurf's MCP integration lacks essential security controls, allowing AI agents to automatically invoke tools without user approval. This creates serious...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/faa590f5296d96f5d474caf632e82ef5?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/faa590f5296d96f5d474caf632e82ef5?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Embrace The Red","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Embrace The Red","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/50e27c500f1444fd9ed7d91301ed2e9c","url":"https://daily.dev/sources/embracethered"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/windsurf-mcp-integration-missing-security-controls-put-users-at-risk-embrace-the-red-9dobjzmia","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,mcp,prompt-injection,security,windsurf","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Embrace The Red","item":"https://daily.dev/sources/embracethered"},{"@type":"ListItem","position":3,"name":"Windsurf MCP Integration: Missing Security Controls Put Users at Risk · Embrace The Red"}]} ```