MCP STDIO Flaw: Anthropic Calls RCE Risk 'Expected Behavior'
OX Security found MCP's default STDIO transport runs arbitrary OS commands, exposing an estimated 200,000 servers; Anthropic calls it expected behavior.
The Model Context Protocol (MCP) is an open standard for connecting AI models and agents to external tools, data sources, and services. Developers don't need to build a custom integration for every application. Instead, they can expose capabilities through an MCP server, and any compatible AI client can discover and call them. That design has made MCP a common foundation for agentic AI, where assistants act inside real systems instead of only answering questions.
MCP has moved from experimental side project to mainstream infrastructure. Major AI platforms now support it in developer tooling and agent frameworks. Consumer and business messaging services are adopting it so agents can handle tasks like account setup. MCP servers are also appearing in curated marketplaces, which makes them easier to find and install.
This growth has brought scrutiny. When an AI agent gains write access to email, files, or business systems, a flawed server or a manipulated prompt can cause real damage. Researchers have reported design-level weaknesses and assigned vulnerabilities. Platform vendors have acknowledged risks in their own MCP modes, and questions remain about how quickly public-sector deployments get patched.
This hub tracks the MCP ecosystem as it matures, including:
Whether you build MCP servers, evaluate them for your organization, or follow agentic AI more broadly, these stories explain how the protocol is shaping the way AI connects to everything else.
OX Security found MCP's default STDIO transport runs arbitrary OS commands, exposing an estimated 200,000 servers; Anthropic calls it expected behavior.
The official MCP Python SDK let malicious servers steal OAuth secrets; fixed in 1.30.0 and 2.2.0, alongside related Rust SDK and LiteLLM auth bugs.
Researchers found most of seven tested MCP clients fail to stop tool poisoning, while a fuzzer uncovered 253 bugs across 118 open-source MCP servers.
Researchers disclosed flaws in Anthropic's Git MCP server enabling code execution and an SSRF in Microsoft's MarkItDown, exposing wider MCP security gaps.
Ox researchers say an MCP design flaw exposes up to 200,000 servers; Anthropic calls it expected, as ChatGPT dev mode adds write access to MCP tools.
OpenAI's ChatGPT developer mode lets users connect any MCP server, and its own docs warn of prompt injection, risky write actions, and malicious servers.
Zenity, Noma and Obot say OpenAI's AgentKit guardrails and ChatGPT's MCP developer mode leave data and write-access risks that enterprises must govern.
Five U.S. federal MCP servers remain unpatched against a spec-level flaw disclosed by ClawSecure as the AI agent protocol spreads into government systems.
At DevDay 2026, OpenAI added ChatGPT support for the draft MCP Events spec (webhooks only), plus Agents API computer use and cloud-based Codex.
MCP's stateless 2026-07-28 spec is now the baseline as TikTok, Google and Microsoft expand MCP access, while audits find thousands of unchecked public servers.
Meta launches a WhatsApp Business Tools MCP server letting AI agents like Claude and ChatGPT handle setup, templates and testing.