Anthropic MCP Flaw: Why 200,000 Servers Remain Exposed

Months after security researchers disclosed a command-execution weakness in the Model Context Protocol, the issue remains unresolved at its source. The reason is not a stalled fix. Anthropic, which created MCP, considers the behavior part of the design.

What OX Security found

In April 2026, OX Security's research team disclosed a systemic flaw in MCP's STDIO transport.1 STDIO is the local channel an AI process uses to launch an MCP server as a subprocess.1 According to the researchers, that transport executes operating system commands without sanitization or validation, which opens the door to remote code execution on vulnerable hosts.12

One analysis describes the mechanics this way. The STDIO transport runs whatever command is passed to it, whether or not a legitimate MCP server ever initializes.3 The problem is not limited to one language or vendor. It appears in every official MCP SDK, including Python, TypeScript, Java and Rust.3

OX Security estimates the exposure at roughly 200,000 vulnerable instances. These sit within a supply chain covering more than 150 million package downloads.12

"Expected behavior," not a bug

The sources agree on how Anthropic responded. The company called the behavior intentional or expected and declined to change the protocol's architecture.123 The Cloud Security Alliance's lab spells out the result: responsibility for remediation now rests with the individual developers who built on the reference implementation.2

The CSA analysis makes a distinction that explains why this matters. This is not a coding error in a single product. It is a design default embedded in the official SDKs, and it spread downstream to projects that trusted those SDKs as the canonical way to build MCP integrations.2 When the reference implementation is the vulnerability, patching one popular package cannot close it.

Anthropic's position does have some logic, at least as an argument. A local transport whose job is to launch a process will, by nature, run commands. The real question is whether a standard should ship with that capability unguarded by default. Startup Fortune's framing puts it directly: should a tool-calling standard let a subprocess run arbitrary, unsanitized commands at all?1

A wider pattern of MCP weaknesses

The STDIO issue is the headline flaw, but it is one of many. The CSA describes MCP as one of the most rapidly weaponized attack surfaces in agentic AI. It notes that the specification offers no native defenses against tool poisoning or "rug pull" attacks.2

Other findings point the same way:

• A separate technique, dubbed agentjacking, bypassed explicit anti-injection instructions in 85% of tested cases.3
• About 38–40% of scanned MCP servers run with no authentication at all.3
• Session hijacking now appears as a bug inside official SDKs, not just as a deployment mistake.3
• More than 30 CVEs were filed against MCP servers in a single 60-day window in early 2026. Around 43% of them involved command-injection patterns.4

Some of these bugs have hit Anthropic's own code. Three CVEs disclosed in January 2026 affected Anthropic's Git MCP server, covering path traversal and argument injection.4 Others have been exploited in the wild. CVE-2026-33032, nicknamed "MCPwn" and affecting nginx-ui's MCP integration, carried a CVSS score of 9.8 and was actively exploited before being patched in March 2026.4 Practical DevSecOps also cites a supply-chain attack that silently BCC'd emails from more than 437,000 environments.4

Where the accounts differ

The sources largely agree on the facts, but their emphasis differs. Startup Fortune and the CSA focus on the STDIO design decision and Anthropic's refusal to change it.12 The SaaS Library's coverage treats the STDIO flaw as the most significant of several unpatched problems.3 Practical DevSecOps focuses on CVE volume and exploitation data across the broader MCP ecosystem, not on Anthropic's specific choice.4 Business-oriented coverage lists the "MCP security row" alongside Anthropic's reported $30 billion funding round and cheaper Claude pricing.5 That pairing suggests the dispute has become part of how the company is judged, not just a niche developer concern.

The takeaway

This is a classic platform-responsibility standoff. Anthropic is treating MCP like a low-level primitive whose safe use is the integrator's job. Critics argue that a protocol promoted as the standard way to connect AI agents to tools should be secure by default. Given how many developers simply adopt the official SDKs, the CSA's concern seems justified: a permissive default effectively becomes everyone's security policy.2

For teams running MCP today, the practical message is plain. No upstream fix is coming for the STDIO behavior. Practical defenses include:

• validating and allowlisting the commands passed to STDIO transports;
• requiring authentication on exposed servers;
• treating third-party MCP servers as untrusted code.

As agentic AI spreads, MCP's early design defaults could prove hard to reverse, and the bill for that is landing on downstream developers.