Databricks traced roughly $1.2 million a year in wasted spend to seven MCP bugs. Engineers fixed them in about an hour using Databricks Unity Gateway and Genie One.
The trouble sat in internal Jira and Google Drive and Docs tool servers. No remote exploit was needed. Any agent that sent a plausible JSON type could kick off the loop.
How the attack actually works
Unity Gateway spits out an OpenTelemetry trace for every MCP call, capturing tool name, arguments, errors, tokens and latency. Genie One queried that table in plain English and ranked failures by volume and cost.
The worst offender logged 535 failures a day. It triggered when the model sent an array for the fields parameter instead of a comma string. The server called .split() on a list, threw "'list' object has no attribute 'split'", and the agent retried for 12 turns on average. Picture a vending machine that only takes exact change and jams. The user does not walk away. They shake it, try again, burn time and money.
Why this matters, and what it does not fix
The pattern is quiet. Tasks still complete, so aggregate dashboards read it as healthy usage growth. At Databricks, it added up to 1,409 errors a day, $499K in annual token waste and 12,023 hours of wait time, with one Drive error hitting 49.6% of drive_file_get calls.
