Security firm OX Security just dropped a bombshell: there's a design-level remote code execution (RCE) vulnerability in the Model Context Protocol (MCP), the open protocol spearheaded by Anthropic that's become the de facto standard for AI agents to call external tools. An attacker could execute arbitrary commands on any system running a vulnerable MCP implementation, potentially grabbing user data, internal databases, API keys, and chat logs. The kicker? This isn't a bug in someone's sloppy code—it's baked into the default behavior of Anthropic's official SDKs for handling STDIO transport, and it affects the Python, TypeScript, Java, and Rust versions.
STDIO is one of MCP's transport methods, letting local processes communicate via standard input/output. The StdioServerParameters in the official SDK directly spawns a child process based on command parameters in the configuration. If a developer doesn't add extra input sanitization, any user input that reaches this point gets executed as a system command. OX Security breaks down the attack surface into four categories: directly injecting commands into a configuration interface; using allowed commands from a whitelist and adding line terminators to bypass sanitization (like npx -c <command>); using prompt injection in an IDE to rewrite an MCP config file, letting tools like Windsurf spin up a malicious STDIO service without user interaction; and sneaking STDIO configurations into HTTP requests via the MCP marketplace.
OX Security's numbers paint a grim picture: affected packages have been downloaded over 150 million times, with more than 7,000 publicly accessible MCP servers exposing up to 200,000 instances across 200+ open-source projects. The team submitted over 30 responsible disclosures and secured more than 10 high or critical severity CVEs, covering AI frameworks and IDEs like LiteLLM, LangFlow, Flowise, Windsurf, GPT Researcher, Agent Zero, and DocsGPT. Out of 11 MCP package repositories they tested, nine were vulnerable to having malicious configurations slipped in this way.
After disclosure, Anthropic's response was essentially: that's not a bug, it's a feature. The company called it "expected behavior" (by design), stated that STDIO's execution model is a "safe default design," and shifted the responsibility for input sanitization onto developers, refusing to make changes at the protocol or official SDK level. Vendors like DocsGPT and LettaAI have already issued their own patches, but Anthropic's reference implementation remains unchanged.
MCP is already the go-to protocol for connecting AI agents to external tools, with OpenAI, Google, and Microsoft all adopting it. With the root cause unaddressed, any MCP service that uses the official SDK's default STDIO connection—even if its own code is flawless—could become an attack vector. This comes at a time when Anthropic is under increased scrutiny for its security-related models, as seen when the White House Chief of Staff planned to meet with CEO Dario Amodei over the company's new Mythos model.