MCP protocol vulnerability enables remote code execution across millions of systems
Security researchers at OX Security discovered a fundamental architectural flaw in Anthropic's Model Context Protocol that enables remote code execution across over 150 million downloads by allowing arbitrary command injection through the STDIO interface. The vulnerability affects thousands of servers and downstream AI projects, with researchers successfully demonstrating attacks on live production platforms; Anthropic regards it as expected behavior.
What happened
A fundamental design flaw in Anthropic's Model Context Protocol (MCP) STDIO transport mechanism enables remote code execution through arbitrary command injection. The STDIO interface executes any command passed in configuration regardless of whether it succeeds, allowing attackers to run arbitrary OS commands if the command creates an STDIO server or by returning an error after execution.
MCP was launched in late 2024 as an open standard to connect large language models to external tools, databases, and services across Python, TypeScript, Java, and Rust implementations. The vulnerability affects downstream projects including LiteLLM, LangChain, LangFlow, Flowise, LettaAI, and LangBot.
Reported impact
The vulnerability affects over 150 million downloads and leaves more than 7,000 publicly exposed servers at risk, with scans identifying up to 200,000 vulnerable instances total. Attackers gaining access can exfiltrate databases, chat histories, API keys, and other secrets from affected systems.
Eleven CVEs have been assigned across four exploit categories: unauthenticated command injection via STDIO, authenticated variants, hardening bypasses, and zero-click prompt injections through configuration edits or marketplaces. OX Security researchers successfully executed commands on six live production platforms with paying customers and bypassed security checks on 9 out of 11 major MCP marketplaces.
Index analysis
The vulnerability exists at the protocol architectural layer rather than in individual implementations, creating a cascade effect across the AI supply chain. Because the flaw is baked into the STDIO interface from the protocol's inception, all implementations regardless of programming language inherit the risk.
Governance controls
Anthropic has characterized the vulnerability as expected behavior rather than a design flaw. The issue remains largely unpatched in the wild as developers must vigilantly address the flaw themselves in their implementations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.