The report
In a separate environment examined by Wiz, GraphQL fields named mcpCommand and mcpArgs were fed into a Python subprocess execution path. This removed the distinction between an API caller requesting an agent tool and a backend process executing arbitrary host commands. The investigation recovered more than 150 scripts across approximately twenty-one hours and described root-level effects, pod persistence attempts and credential-access activity.
This finding is not an ordinary prompt string trick. The decisive connection was the executable backend sink: untrusted command arguments reached create_subprocess_exec without a sufficient authority check. Wiz also observed an attacker target list naming roughly twenty-five fintech organizations. Listing an organization as a candidate target is not proof that it was breached, and an uncorroborated claim about hundreds of thousands of stolen rows does not establish exfiltration.
The specific GraphQL MCP investigation and Wiz evidence identify observable backend actions separately from the attacker's assertions. The defensible control is to enforce tool identity, argument restrictions and process privilege at the backend boundary, then verify pod changes and actual outbound data. A read-like MCP label cannot authorize a process effect merely because it arrived through a model-friendly protocol.