Anthropic in 2026: MCP Security Row, $30B Round, Cheaper Claude

Anthropic is the AI lab behind the Claude model family and the creator of the Model Context Protocol (MCP), the plumbing that lets AI agents talk to outside tools. In 2026 the company is defined by three things: a protocol that much of the industry now runs on, a fundraising environment that has made it one of the best-capitalized companies in tech, and an aggressive push to make its models cheaper. Its year shows both how strong its position is and how much it now has to answer for.

The MCP dispute: feature or flaw?

MCP has become close to an industry standard. OpenAI adopted it in March 2025, Google DeepMind followed, and Anthropic donated the protocol to the Linux Foundation in December 2025. Downloads have passed 150 million. 1

That reach is why a report from OX Security drew so much attention. Researchers Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok and Roni Bar found that MCP's STDIO transport, the default way an agent connects to a local tool, will run any operating system command it is given. It does no sanitization and draws no line between configuration and execution. If a malicious command fails, the error appears only after the command has already run. 1 According to OX, this is an architectural choice built into Anthropic's official SDKs for Python, TypeScript, Java and Rust, not a coding slip. 34

The exposure estimates come with a caveat. OX found about 7,000 publicly reachable servers with STDIO active. It then extrapolated to roughly 200,000 vulnerable instances, which makes that number a projection rather than a count. 1 The team reported confirmed exploitation, including remote code execution on LettaAI and server takeover on LangFlow. 4 One account says the work ran from November 2025 to April 2026 and produced more than 30 disclosure reports and about ten CVEs across the ecosystem. 2 OX published its findings on April 15, after notifying Anthropic on January 7. 3

Anthropic's answer has not changed. It says STDIO is doing what it was built to do, spawning processes and talking to them, and calls the behavior "expected." 23 One analysis reports the issue was still unpatched as of August 2026. It warns that separate fixes to Anthropic's Git MCP server should not be taken as proof that the reference stack is now secure. 4 Third-party vendors are already selling the guardrails the protocol leaves out. 2

Anthropic has a narrow technical point: a transport that launches local processes will, by design, launch processes. The stronger argument runs the other way, though. When a protocol becomes default infrastructure, its defaults turn into everyone's attack surface. Handing MCP to the Linux Foundation spread out governance, but responsibility for those default settings still sits mostly with Anthropic.

Funding: sovereign money and a cooling Nvidia

Anthropic's finances reflect a wider shift in who pays for frontier AI. In the first quarter of 2026, global venture funding reached about $297 billion, and AI took roughly 81% of it. 8 A separate tally puts the AI share at $242 billion of about $300 billion. 7 Singapore's GIC co-led Anthropic's $30 billion round, and the Qatar Investment Authority also invested. 8 Analysts say ordinary VC firms cannot fund rounds this large, which has made sovereign wealth funds the main backers of frontier labs. 67

The chip side looks less certain. Nvidia CEO Jensen Huang told a Morgan Stanley conference that Nvidia's $10 billion investment in Anthropic would likely be its last, and he described its $30 billion OpenAI stake the same way. 5 One reading is that corporate investment in the top labs may be close to its limit. 9 For Anthropic, that likely means relying more on sovereign and strategic investors for future rounds.

Product: competing on price

Competition is intense. OpenAI began rolling out GPT-6 in ChatGPT on October 7, 2026, along with an "Intelligent UI" that answers with interactive charts, forms and tools. 1011 Not all of the reception was warm, and some developers in OpenAI's own forum complained. 11

Anthropic's answer has centered on cost. Claude Haiku 5.5 is priced at $0.10 per million input tokens and $0.50 per million output tokens for prompts under 100,000 tokens, a tenth of Haiku 4.5's rates. Its OSWorld agentic benchmark score rose from 15.7% to 72.4%. In one hands-on test, both Haiku versions scored 24/24, but the newer model's run cost under a cent compared with about $0.25. 12

The bottom line

Anthropic sets standards, attracts sovereign money and drives prices down. Its approach of building cheaper, more capable agents depends on the same tool connections that the MCP dispute calls into question. As agents take on more real work, how safe their connections are by default will matter as much as how capable or cheap the models are. On that point, Anthropic has so far chosen not to act.