The Model Context Protocol (MCP) is Anthropic’s open standard that lets AI models communicate with external tools and data sources. It’s the bridge between Claude and the real world — and that bridge now has a massive hole in it.
The problem: arbitrary command execution
The security team at OX Security discovered an architectural vulnerability in MCP’s STDIO mechanism. In plain terms: the standard input/output channel allows arbitrary OS command execution. Anyone who can reach a vulnerable MCP server gains access to sensitive user data, internal databases, API keys, and chat histories.
The numbers are impressive — in the worst way: approximately 200,000 servers are affected, with software packages totaling over 150 million downloads across Python, TypeScript, Java, and Rust.
Four attack vectors, nine out of eleven marketplaces poisoned
The researchers identified four distinct attack families.
First: unauthenticated command injection in popular AI frameworks like LangFlow and GPT Researcher. Second: hardening bypasses in supposedly protected environments like Flowise. Third: zero-click prompt injection in leading AI IDEs — Windsurf and Cursor are among those affected. Fourth: MCP marketplace poisoning. Out of eleven tested marketplaces, nine accepted malicious submissions.
This isn’t an edge case. It’s a systemic problem.
Anthropic’s response: ‘expected behavior’
And here’s where it gets really interesting. Anthropic declined to modify the protocol’s architecture. The official reason: the behavior is “expected.” One week after the initial report, Anthropic quietly updated its security policy to suggest caution with STDIO adapters.
The OX Security researchers commented dryly: “That didn’t fix anything.”
What you can do
If you’re running MCP servers or using MCP-based tools: review your configuration. Use authenticated connections instead of STDIO where possible. And keep an eye out for updates — because even if Anthropic is downplaying the issue, the community won’t ignore it.
The irony is obvious: Anthropic just showed the world with Mythos how serious cybersecurity should be taken. And at the same time, the company says about the security flaw in its own protocol: “expected behavior.”
Sources: