Anthropic's Model Context Protocol has critical flaw exposing 200,000 servers to remote takeover

Critical Design Flaw Threatens AI Infrastructure at Scale

Cybersecurity researchers at OX Security have exposed a critical architectural vulnerability in Anthropic's Model Context Protocol that puts up to 200,000 AI servers at risk of complete takeover through remote code execution1

1

. The security vulnerability affects MCP's official SDKs across Python, TypeScript, Java, and Rust, creating a ripple effect throughout the AI supply chain that spans more than 150 million downloads2

2

. What makes this discovery particularly concerning is that Anthropic has declined to implement a protocol-level fix, telling researchers the behavior was "expected"3

3

.

The Model Context Protocol is an open standard Anthropic created in late 2024 to enable AI models to connect to external tools, databases, and APIs. It was donated to the Linux Foundation's Agentic AI Foundation in December and has since been adopted by OpenAI, Google, and most major AI coding tools1

1

. This widespread adoption means the vulnerability's impact extends far beyond Anthropic's own products.

How the Remote Code Execution Flaw Works

The critical design flaw lies in how MCP handles local process execution over its STDIO transport interface. User-controlled input can flow directly into command execution without input sanitization—an architectural design decision baked into the reference MCP SDKs4

4

. According to OX Security researchers Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok, and Roni Bar, this means every developer building on MCP inherits the exposure by default3

3

.

The researchers explained that while the STDIO code was intended to start a local server and return a handle to the LLM, "in practice it actually lets anyone run any arbitrary OS command." If the command successfully creates an STDIO server, it returns the handle, but when given a different command, it returns an error after the command is executed2

2

.

Four Attack Vectors Identified Across AI Applications

OX Security's research team identified four families of exploitation that demonstrate the breadth of the attack surface. The first involves unauthenticated and authenticated command injection, allowing attackers to enter user-controlled commands that run directly on the server without authentication or sanitization, potentially leading to total system compromise. Vulnerable projects include all versions of LangFlow, IBM's open-source low-code framework for building AI applications, and GPT Researcher, an open-source AI agent designed for deep research2

2

.

The second attack vector enables hardening bypasses in tools like Flowise and Upsonic that implemented protections against command injection. Researchers successfully bypassed these safeguards by indirectly injecting commands via allowed command arguments, such as "npx -c "2

2

. The third vulnerability type allows zero-click prompt injection across AI IDEs and coding assistants including Windsurf, Claude Code, Cursor, Gemini-CLI, and GitHub Copilot1

1

.

The fourth exploitation method involves malicious package distribution through MCP marketplaces. The researchers successfully poisoned nine out of 11 MCP registries with a test payload and confirmed command execution on six live production platforms with paying customers1

1

.

Ten CVEs Issued, But Root Cause Remains Unpatched

The research produced at least 10 CVEs rated high or critical severity. LiteLLM (CVE-2026-30623) and Bisheng (CVE-2026-33224) have been patched, while Windsurf (CVE-2026-30615), which allowed zero-click local code execution, remains in a "reported" state alongside flaws in GPT Researcher, Agent Zero, LangChain-Chatchat, and DocsGPT1

1

. Other affected projects include Flowise (CVE-2026-40933), Upsonic (CVE-2026-30625), and Fay Framework (CVE-2026-30618)3

3

.

OX Security said it repeatedly recommended a protocol-level fix to Anthropic, such as manifest-only execution or a command allowlist in the MCP SDKs, that would have protected downstream users immediately1

1

. However, Anthropic declined and didn't object when the researchers said they intended to publish their report. A week after the initial report to Anthropic, the AI vendor quietly released an updated security policy advising that MCP adapters, specifically STDIO ones, should be used with caution. "This change didn't fix anything," the researchers noted2

2

.

Timing Raises Questions About Security Priorities

The exposure comes less than a week after Anthropic launched Claude Mythos, a frontier model promoted as a tool to find security vulnerabilities in other organizations' software. OX researchers noted that the findings were "a call to action" for Anthropic to apply that same commitment to its own infrastructure1

1

. The incident also follows the accidental leak of Claude Code's full source code through a public npm package at the end of March, which exposed roughly 500,000 lines of unobfuscated TypeScript before Anthropic pulled the file1

1

.

While MCP is now under the Linux Foundation's governance, Anthropic remains responsible for maintaining the reference MCP SDKs where the vulnerability originates. Until its STDIO handling is changed at source, project maintainers will have to implement their own input sanitization1

1

. The researchers emphasized that "shifting responsibility to implementers does not transfer the risk. It just obscures who created it"3

3

. They recommend organizations block public IP access to sensitive services, monitor MCP tool invocations, run MCP-enabled services in a sandbox, treat external MCP configuration input as untrusted, and only install MCP servers from verified sources3

3

.