Model Context Protocol (MCP)

OX Security disclosed a systemic architectural weakness in Anthropic's Model Context Protocol that enables arbitrary command execution across implementations, rooted in unsafe STDIO transport defaults permitting configuration-to-command execution. It affects the MCP SDK in Python, TypeScript, Java and Rust simultaneously, with more than 7,000 publicly accessible servers and over 150 million downloads across downstream projects including LiteLLM, LangChain, LangFlow, Flowise and LettaAI. Successful attacks give access to sensitive data, databases, API keys and chat histories. Anthropic declined to modify the protocol architecture, characterizing the behaviour as expected; some vendors patched independently while the reference implementation remained unaddressed at publication.