MCP STDIO Flaw: Anthropic Calls RCE Risk 'Expected Behavior'

What happened

The Model Context Protocol has become the standard way AI agents connect to tools. It now has a security problem that its creator says is not a problem at all.

Researchers at OX Security (Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok and Roni Bar) found that MCP's STDIO transport executes whatever operating system command it receives. STDIO is the default mechanism for wiring an agent to a local tool. The transport does no sanitization and draws no boundary between configuration and command. If the command is malicious, the error only comes back after it has already run, and the developer toolchain raises no warning 1. AIBase's coverage adds that the command executes even when the server itself fails to start 3.

The work was not a one-off finding. The team spent roughly six months, from November 2025 through April 2026, probing the ecosystem. They filed more than 30 responsible disclosure reports, and around ten CVEs followed in downstream projects 2. OX published its report on April 15 3.

Scale: real, but partly estimated

The headline figure is 200,000 exposed instances, but it needs a caveat. OX found about 7,000 servers on public IP addresses with STDIO transport active. The 200,000 number is an extrapolation from that ratio, not a direct count 1. Some coverage reports the larger number as settled fact 3. The careful reading is that 7,000 servers were observed and the wider exposure is modeled.

The reach is still substantial. According to AuthZed's analysis, the behavior sits in Anthropic's official SDKs for Python, TypeScript, Java and Rust. Those SDKs underpin more than 150 million downloads 4. OX confirmed arbitrary command execution on several live platforms 1. AuthZed specifically cites remote code execution on LettaAI and server takeover on LangFlow 4.

MCP's footprint makes this more than one vendor's issue. Anthropic created the protocol, OpenAI adopted it in March 2025, and Google DeepMind followed. In December 2025 Anthropic handed MCP to the Linux Foundation 1. A flaw in the reference transport therefore touches nearly every major agent stack.

Anthropic's position: working as designed

OX notified Anthropic on January 7. Anthropic replied that the behavior was "expected" 3. It declined to change the protocol, reasoning that STDIO does what it was built to do: spawn processes and talk to them over standard input and output 2.

AuthZed reports that the STDIO behavior was still unpatched as of August 2026 4. AuthZed contrasts this with a separate set of Git MCP server CVEs that Anthropic did fix. It argues that the Git cleanup was isolated and should not be read as proof that the reference stack is now safe 4.

Where the accounts diverge

The sources agree on the mechanics but differ in emphasis.

• VentureBeat frames it as a feature-versus-flaw dispute and is precise about how the exposure was estimated 1.
• AIBase stresses OX's point that this is an architectural decision, not a coding slip 3.
• AuthZed places it within a broader pattern of MCP reference-implementation bugs 4.
• MCPProxy treats Anthropic's stance as an opening for third-party guardrails, arguing that someone has to supply the security defaults the protocol won't 2. MCPProxy sells exactly that kind of layer, so its framing carries a commercial interest. Its core claim still matches the other accounts.

Why it matters

Anthropic's position is technically coherent. A transport whose job is to launch local processes will, by definition, launch processes. But a design can be coherent and still be a poor default.

MCP's appeal is that developers can drop a server definition into a config file and an agent gains a new capability. That convenience is the attack surface. Whoever controls the config controls command execution on the host. This makes MCP server directories and marketplaces especially sensitive. Configurations get shared, copied and installed with little review, and nothing in the default toolchain signals that something has gone wrong.

By declining a protocol-level fix, Anthropic has pushed security down to every client, SDK consumer and platform operator. The roughly ten CVEs filed against downstream projects suggest that model is not working well 2. Each implementer has to rediscover the same hazard and patch it independently.

What teams should do

Until the protocol changes, security teams should treat MCP STDIO configurations as executable code, because they are. Practical steps include:

• Inventory where STDIO transport is enabled, especially on internet-facing hosts.
• Restrict who can write server definitions.
• Vet third-party server configs before installing them.
• Consider sandboxing or proxy layers that enforce an execution boundary the protocol does not.

The broader lesson is about governance. MCP now sits under the Linux Foundation, and whether "expected behavior" stays the official answer may become an early test of that stewardship.