MCP lets an AI agent run commands; up to 200,000 servers would run an attacker's too

01What MCP is: a menu of tools and a way to order from it

Three parties take part. The model is the language model that reads and writes text. The client is the application you type into, such as a chat assistant or a coding editor. A server is a small program that offers tools: “search deals”, “create ticket”, “run query”. In the specification’s words, tools “enable models to interact with external systems, such as querying databases, calling APIs, or performing computations.”⁷

The model never touches your CRM itself. It reads a menu of tool names and descriptions, picks one, and fills in the order form. The client delivers the order; the server does the work with whatever access it was given. Tools are “model-controlled”, the specification says: the model decides when to call them.⁷

Step 6 matters later. The model cannot tell an instruction from data: a web page or document a tool fetches can carry text that reads like an order, and the model may act on it. That is prompt injection, and it is one of the four routes OX documents.³

02Where a configuration line becomes a command

MCP defines two standard ways for a client to reach a server.⁶ With Streamable HTTP, the server is a web service somewhere, reached at an address such as https://example.com/mcp. With STDIO, the server is a program on the same machine: “The client launches the MCP server as a subprocess,” then talks to it through the program’s standard input and output. The specification adds that “Clients SHOULD support stdio whenever possible.”⁶

To launch that program, the client needs to know what to run, so each STDIO server is a configuration entry holding a command and its arguments. OX’s intended example is python myapp.py. Its malicious one is rm -rf /, which deletes everything the process can reach.² The client does not check that the command is an MCP server before running it. In OX’s words, “if the command successfully creates an STDIO server it will return the handle, but when given a different command, it returns an error after the command is executed.”²

03What OX Security found: 17 products, four routes, most unpatched

OX Security’s research team published three documents on 15 April: an overview, a technical deep dive and a disclosure advisory.¹²³ It calls the issue an architectural design decision in Anthropic’s official MCP SDKs, present across Python, TypeScript, Java and Rust, rather than a coding error. It reports 150 million-plus downloads of the affected software, more than 7,000 publicly reachable servers, and more than 200 open-source projects touched; it ran commands on six live production platforms.¹

The advisory sorts the cases into four routes by which an attacker’s input reaches the configuration entry.³ Command injection through the interface (11 products): a web console such as LangFlow, GPT Researcher, Agent Zero, Langchain-Chatchat or Fay数字人 (Fay Digital Human) lets a visitor add an “MCP server” with any command, in several cases without logging in. Hardening bypass (2): Flowise and Upsonic allowed only npx and npm, but those accept flags that run anything; OX’s payload was npx -c.² Prompt injection (1): in the Windsurf editor, a malicious web page tells the agent to edit its own mcp.json, with no click from the user, CVE-2026-30615. Hidden STDIO configurations (3): a request quietly switches a connection’s type from web to STDIO, as in DocsGPT and LettaAI.³ Separately, OX says 9 of 11 MCP registries accepted its test package.¹

04“Expected”: why the protocol will not change, and who that leaves holding it

OX asked Anthropic to change the design so that developers pre-configure the allowed commands and user input only chooses from that list.² According to OX, Anthropic “declined to modify the protocol’s architecture, citing the behavior as ‘expected’”, and said the STDIO model is a secure default and sanitisation is the developer’s responsibility.¹ We have no statement from Anthropic itself to set beside that account.

Anthropic was not alone. OX names 13 rejected disclosures, among them LangChain’s MCP adapters, FastMCP, AWS Labs, NVIDIA’s NeMo Agent Toolkit, Gemini CLI, Claude Code, GitHub Copilot, Cursor and Firebase Studio. The reasons given: the tool is designed to let the user run code; transport code is not liable for how developers use it; or the code already runs inside a sandbox. OX accepts the sandbox point and answers that a sandboxed attacker can still mine cryptocurrency, proxy traffic and take free compute.³ Nor is the class new: OX lists five earlier CVEs from other researchers on the same root cause in 2025 and 2026, including MCP Inspector (CVE-2025-49596) and Cursor (CVE-2025-54136).³

05Five controls a company sets, whatever its agents run on

Each control below removes something an attack in OX’s set relied on; most are OX’s own recommendations, and none needs the protocol to change.¹

1. Allowlist the commands, with their arguments. OX’s advice is to block external configuration input entirely or let it choose only “trusted pre-configured commands.”¹ Flowise is the warning: it allowed npx by name and was beaten by npx -c, so a list must fix the whole command line, not the program name.²
2. Sandbox every server. Run MCP servers in a container or virtual machine and do not give them full disk or shell access unless the job needs it.¹ Keep cloud keys and session tokens out of the sandbox, since a server that is taken over can read whatever it holds.
3. Keep AI tool consoles off the internet. OX found more than 915 LangFlow instances on Shodan.² The specification already says a local server “SHOULD bind only to localhost” and that servers “SHOULD implement proper authentication.”⁶ Put admin consoles behind single sign-on or a VPN.
4. Install only from a verified registry. OX says to install servers only from official directories, yet 9 of 11 registries took its test package.¹ Keep an internal list of approved servers at pinned versions, and treat a new server like any new software.
5. Watch what leaves. Monitor tool invocations and block suspicious outbound addresses.¹ A reverse shell, a payload download and data theft all need an outbound connection; the specification already asks clients to “log tool usage for audit purposes.”⁷

Then patch what can be patched. LiteLLM is fixed in v1.83.7-stable; for products with no fix, OX’s advice is not to expose them to user input, or to switch them off until a fix ships.¹³