That MCP server on your laptop can read your SSH keys, your cloud credentials and your whole home directory. What the 2026 incident data says, and the controls that fix it.