MCP Protocol Hit by Design-Level RCE Vulnerability; Anthropic Refuses Architecture Changes

Gate News message, April 21 — Security firm OX Security has disclosed a design-level remote code execution (RCE) vulnerability in MCP (Model Context Protocol), the open standard for AI agents to invoke external tools, which is led by Anthropic. Attackers can execute arbitrary commands on any system running a vulnerable MCP implementation, gaining access to user data, internal databases, API keys, and chat histories.

The flaw stems not from implementation errors but from default behavior in Anthropic’s official SDK when handling STDIO transport—affecting Python, TypeScript, Java, and Rust versions. The StdioServerParameters in the official SDK directly launches subprocesses based on configuration command parameters; without additional input sanitization by developers, any user input reaching this stage becomes a system command. OX Security identified four attack vectors: direct command injection via configuration interfaces, bypassing sanitization with whitelisted command flags (e.g., npx -c ), prompt injection in IDEs to rewrite MCP configuration files for tools like Windsurf to run malicious STDIO services without user interaction, and injecting STDIO configurations through HTTP requests in MCP marketplaces.

According to OX Security, affected packages have been downloaded over 150 million times, with 7,000+ publicly accessible MCP servers exposing up to 200,000 instances across 200+ open-source projects. The team submitted 30+ responsible disclosures, resulting in 10+ high-severity or critical CVEs covering AI frameworks and IDEs including LiteLLM, LangFlow, Flowise, Windsurf, GPT Researcher, Agent Zero, and DocsGPT; 9 of 11 tested MCP package repositories could be compromised using this technique.

Anthropicresponded that this is “by design,” calling STDIO’s execution model a “secure default design,” and shifted input sanitization responsibility to developers, refusing to modify the protocol or official SDK. While DocsGPT and LettaAI have released patches, Anthropic’s reference implementation remains unchanged. With MCP becoming the de facto standard for AI agents accessing external tools—followed by OpenAI, Google, and Microsoft—any MCP service using the official SDK’s default STDIO approach could become an attack vector, even if developers write error-free code.