The vulnerability isn't a bug. It's a design philosophy.
That is how Ox Security, a security research firm, frames what it found at the core of Anthropic's Model Context Protocol: an architecture that executes arbitrary commands before validating them — execute first, validate never. The researchers bypassed hardening in a single step by passing a command through the npx flag. The command runs even when the MCP server fails to start. The handshake fails afterward. The payload already ran.
Anthropic's position, delivered to Ox in January and subsequently to journalists, is that this behavior is expected. "This is an explicit part of how stdio MCP servers work," the company told researchers, "and we believe that this design does represent a secure default."
Nine critical CVEs later, the protocol still works exactly the same way.
The scope of what Anthropic won't fix
MCP is the open standard Anthropic released in 2024 to give AI models a common interface for connecting to external tools, databases, and data sources. It has become the de facto communication layer for AI agents — adopted across Python, TypeScript, Java, Go, and eight other language SDKs. The downstream reach is substantial: the MCP Python SDK alone has 73 million downloads, according to figures cited by security researcher flyingpenguin. LiteLLM accounts for 57 million more. FastMCP, 22 million. More than 32,000 repositories depend on these packages. The total MCP ecosystem, across all language implementations, has surpassed 150 million downloads, Computing UK reported.
Ox Security's researchers — Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok, and Roni Bar — began investigating MCP's STDIO transport in November 2025. Over the following months they ran responsible disclosure processes with more than 30 affected projects, and they worked through official channels at Anthropic. The outcome was a 30-page paper, published April 16, and 10 CVEs issued against individual tools and agents that use MCP. Nine of those CVEs are rated critical. The vulnerabilities allow unauthenticated remote code execution on any system running a vulnerable MCP implementation.
The attack surface is not theoretical. Ox found 7,374 publicly accessible servers running vulnerable MCP configurations, with the actual exposure estimated at up to 200,000 instances. Among the confirmed cases: LangFlow, IBM's open-source low-code AI application framework, had 915 instances indexed on Shodan with no authentication required. Full server takeover and data exfiltration was achievable without ever logging in.
Flowise, an AI application platform, had implemented hardening — restricting which commands the STDIO transport would accept, stripping special characters, doing what the documentation says developers should do. Ox bypassed it in one step using npx's -c argument. When the architecture permits arbitrary subprocess execution, application-layer filtering is a wet paper bag.
Nine of 11 MCP code marketplaces accepted a proof-of-concept malicious server during Ox's testing. No security review caught it.
What Anthropic was offered — and declined
Ox proposed four specific protocol-level fixes that would have propagated protection to every downstream project simultaneously: manifest-only execution to replace arbitrary command strings; command allowlisting to block high-risk binaries by default; a mandatory dangerous-mode opt-in flag for any STDIO configuration using dynamic arguments; and marketplace verification standards requiring security manifests signed by verified developer identity. The researchers' argument was straightforward — one architectural change at the protocol level would have protected every downstream developer and end user.
Anthropic declined all four. Its response was to update a security advisory in its documentation, recommending that STDIO-based MCP adapters "should be used with caution." A documentation change. The vulnerability remains in the code.
"We were able to bypass this behavior by indirectly injecting the command via the allowed command's arguments, for example `-'npx -c <command>'"," Ox wrote. The bypass works against every hardening approach developers have attempted, because the problem is not what developers do with MCP — it is what MCP does by design.
The other major names in the MCP ecosystem took similar positions. LangChain told Ox the responsibility lies with application authors to sanitize untrusted inputs. FastMCP called it per the MCP specification. Google said it was a known issue with no fix planned near-term. Cursor said users must click to accept any mcp.json configuration change. The Register, which reported the story first on April 16, found no vendor willing to characterize the behavior as a security flaw rather than expected functionality.
The Glasswing problem
Anthropic launched Project Glasswing in April, a $100 million cybersecurity initiative that uses its unreleased Mythos model to find zero-day vulnerabilities in third-party software. AWS, Apple, Google, Microsoft, and CrowdStrike are listed as official participants. The initiative positions Anthropic as a defender of the broader software ecosystem — the entity that will find the vulnerabilities that others miss.
Flyingpenguin noted the contradiction directly: "Why would you trust a company to find vulnerabilities in your code when it classifies arbitrary command execution in its own protocol as expected behavior?" The architectural fixes Anthropic declined would have been cheap relative to Glasswing's scope. They would have protected every project that depends on MCP today, without waiting for a new model to find bugs in someone else's code.
The question Ox's researchers put plainly: "One architectural change at the protocol level would have protected every downstream project, every developer, and every end user who relied on MCP today. That's what it means to own the stack."
Anthropic did not respond to The Register's inquiries for this story. The company has not issued a protocol-level fix. The STDIO transport still executes commands before validating them. The next CVE is likely a matter of time.
Research by Ox Security. Additional reporting by The Register, Computing UK, and TechRadar.
