MCP Security: Design Flaw, CVEs and ChatGPT Write Access Risks

The Model Context Protocol has become the default way to wire AI assistants into real business systems. It now faces a security reckoning that is as much about governance as about code. Two threads are converging. Researchers argue the protocol carries a structural weakness that its steward, Anthropic, won't fix. Meanwhile, OpenAI's adoption of MCP in ChatGPT has made it easier than ever to point a consumer-facing chat window at internal infrastructure.

The "design flaw" dispute

Security researchers at Ox say a flaw baked into Anthropic's official MCP puts as many as 200,000 servers at risk of complete takeover 2. Whether it is called a design flaw or expected behavior stemming from a poor design choice depends on who is describing it 2. The Ox team says it began the work in November 2025 and ran more than 30 responsible disclosure processes 2.

The disclosures produced at least 10 high- and critical-severity CVEs so far. They were issued against individual open source tools and AI agents that use MCP rather than against the protocol itself 2. That distinction is the heart of the disagreement. Ox says it repeatedly asked Anthropic to address the root cause. A fix at the protocol level, the researchers argue, could have reduced risk across packages with more than 150 million combined downloads and protected millions of downstream users 2. Anthropic declined to change the protocol's architecture and described the behavior as "expected" 2. According to the researchers, Anthropic quietly released an updated security policy about a week after their initial report 2.

The effect is that the burden lands on every implementer. Each tool maker patches its own instance of the same underlying pattern, one CVE at a time. This is how security debt accumulates. When a weakness lives in shared plumbing but fixes happen downstream, the number of vulnerable deployments tends to grow faster than the patches.

ChatGPT widens the blast radius

The second thread is adoption. OpenAI added MCP support to ChatGPT's developer mode in September 2025, and the feature was described at the time as "powerful but dangerous" 3. It lets developers link external MCP servers directly to ChatGPT 3. Around the same period, OpenAI pushed ChatGPT further toward being a platform, with its Apps SDK and Agent Kit unveiled at DevDay 2025 3.

Obot, which sells MCP governance tooling, lays out the enterprise risk. Any paid user, including someone on a Plus plan, can enable developer mode, paste an internal MCP server URL into ChatGPT's connector settings, and start acting on company systems 1. Those actions are not limited to reads. Creating records, updating databases, modifying files and triggering workflows are all available 1. Obot's illustrative scenario is an engineer running write operations against a production CRM from a chat session that IT cannot see, audit or revoke. Security learns about it the way it learns about most shadow AI, after the fact 1.

Obot is a vendor with a product to sell, so its framing should be read accordingly. Still, its core point lines up with the Ox findings. MCP servers that organizations have already deployed were often built assuming a narrower set of clients. Opening them to a widely used chat product changes the threat model for that existing infrastructure 1.

Where the sources agree, and where they don't

Ox and Obot come at the problem from different angles. Ox focuses on protocol-level weaknesses and vendor accountability 2. Obot focuses on operational controls inside the enterprise 1. VentureBeat's coverage mostly documents how quickly MCP and agent tooling are spreading through OpenAI's ecosystem 3. Together they point to the same picture: MCP's reach is expanding quickly while its security model remains contested.

Obot proposes four prerequisites before enabling ChatGPT's MCP support [1]:

• a centralized gateway
• an approved registry of servers
• tool-level role-based access control
• audit logging of every tool call

These are sensible controls. They are also compensating measures, layered on because the protocol itself does not enforce them.

The takeaway

The most consequential fact here is Anthropic's position, not any single CVE count. If the protocol's maintainer treats the behavior Ox flagged as working as intended, organizations should assume protocol-level fixes are not coming soon. They should plan on owning the risk themselves.

In practice, that means:

• treating every MCP server as an exposed attack surface
• inventorying which servers exist and who can reach them
• routing access through controlled gateways rather than individual chat accounts

MCP's appeal is that it makes connecting AI to tools trivially easy. That same ease is now its central security problem.