Security teams at Google, JPMorgan Chase, Weaviate, France’s interministerial digital directorate (DINUM) and the city government of Tangerang in Indonesia have each fixed the same type of flaw in their Model Context Protocol (MCP) servers.