---
title: "MCP lets an AI agent run commands; up to 200,000 servers would run an attacker's too"
summary: "How the Model Context Protocol lets an AI agent call tools, why its local mode runs any command it is given, and five controls to set, from OX Security's research of 15 April 2026."
url: https://www.thetechbag.com/blog/mcp-explained-ai-agents-run-commands
format: Analysis
desk: "AI in the enterprise"
published: 2026-04-15
facts_checked: 2026-04-15
author: TechBag (The TechBag Journal)
tags: ["MCP","Model Context Protocol","AI agents","OX Security","STDIO","prompt injection","CVE-2026-30615","LiteLLM","LangFlow","Windsurf","CERT-In","DPDP"]
cover: https://www.thetechbag.com/blog/covers/mcp-explained-ai-agents-run-commands.png
---

# MCP lets an AI agent run commands; up to 200,000 servers would run an attacker's too

*How the Model Context Protocol lets an AI agent call tools, why its local mode runs any command it is given, and five controls to set, from OX Security's research of 15 April 2026.*

Analysis · AI in the enterprise · By TechBag · Published 2026-04-15 · Facts checked 2026-04-15 · Canonical: https://www.thetechbag.com/blog/mcp-explained-ai-agents-run-commands

The short version

- The Model Context Protocol (MCP) is the standard plug between an AI assistant and the tools it uses. One of its two ways of connecting, called STDIO, starts a program on the machine from a command written in a configuration entry, so whoever can write that entry chooses what runs.[6][2]
- On 15 April OX Security published 17 AI products where an attacker’s input reaches that entry: 14 carry CVE identifiers, 15 are rated critical, and 13 had no fix stated on the day. OX puts the exposure at up to 200,000 instances. Anthropic, which created MCP, calls the behaviour “expected”, according to OX.[1][3]
- So the fix is the deploying company’s, not the protocol’s. Five controls cover every attack OX describes: allowlist the commands, sandbox the servers, keep AI tool consoles off the internet, install only from a verified registry, and watch outbound traffic.

MCP is about 16 months old and already sits under most AI assistants a business touches. Anthropic open-sourced it on 25 November 2024 as “a new standard for connecting AI assistants to the systems where data lives”.[4] By December 2025 Anthropic counted more than 10,000 active public MCP servers and 97 million monthly SDK downloads, with ChatGPT, Gemini, Microsoft Copilot, Cursor and Visual Studio Code among the adopters.[5] If your developers use an AI coding assistant, or someone has connected a chatbot to your CRM or ticket queue, MCP is probably involved. The question this piece answers: what actually happens when an agent “uses a tool”, why a security firm can say that the same machinery runs an attacker’s commands, and what a company should set so its own agents cannot be turned.

## What MCP is: a menu of tools and a way to order from it

Three parties take part. The **model** is the language model that reads and writes text. The **client** is the application you type into, such as a chat assistant or a coding editor. A **server** is a small program that offers tools: “search deals”, “create ticket”, “run query”. In the specification’s words, tools “enable models to interact with external systems, such as querying databases, calling APIs, or performing computations.”[7]

The model never touches your CRM itself. It reads a menu of tool names and descriptions, picks one, and fills in the order form. The client delivers the order; the server does the work with whatever access it was given. Tools are “model-controlled”, the specification says: the model decides when to call them.[7]

**Figure: The model only chooses; the server acts, with the server's own access**

*One request through MCP, step by step, as the protocol specification (version 2025-11-25) defines it*

Step 1 of 6

1. You ask a question

“Which of my deals closing this month have no follow-up booked?” You type it into the client: a chat assistant or a coding editor.

Source: Model Context Protocol specification, version 2025-11-25: Tools; Transports · as of 15 April 2026 · The example request is ours. Method names (tools/list, tools/call) are the specification's.

Step 6 matters later. The model cannot tell an instruction from data: a web page or document a tool fetches can carry text that reads like an order, and the model may act on it. That is prompt injection, and it is one of the four routes OX documents.[3]

## Where a configuration line becomes a command

MCP defines two standard ways for a client to reach a server.[6] With **Streamable HTTP**, the server is a web service somewhere, reached at an address such as `https://example.com/mcp`. With **STDIO**, the server is a program on the same machine: “The client launches the MCP server as a subprocess,” then talks to it through the program’s standard input and output. The specification adds that “Clients SHOULD support stdio whenever possible.”[6]

To launch that program, the client needs to know what to run, so each STDIO server is a configuration entry holding a command and its arguments. OX’s intended example is `python myapp.py`. Its malicious one is `rm -rf /`, which deletes everything the process can reach.[2] The client does not check that the command is an MCP server before running it. In OX’s words, “if the command successfully creates an STDIO server it will return the handle, but when given a different command, it returns an error after the command is executed.”[2]

**Figure: The check comes after the command has already run**

*How an MCP client starts a local (STDIO) server from its configuration, as described by OX Security, 15 April 2026*

1. 01A configuration entry names a commandFor example `python myapp.py`: a program and its arguments, typed by a user or sent in a request.
2. 02The client starts itThe command runs as a subprocess on the machine, with the permissions of the account running the client.
3. 03Whatever it is, it runsA real MCP server answers. A download-and-run script, a reverse shell or `rm -rf /` simply executes.
4. 04Then the errorIf no MCP server answered, the client reports a failure. The damage is already done.

Source: OX Security, technical deep dive (15 April 2026); MCP specification 2025-11-25, Transports · as of 15 April 2026

Our view

Our view: on a developer’s own laptop, where the developer typed the entry, this is how the feature is meant to work. The danger begins when anything else can write that entry: a web form in a hosted AI app, an API request, or the agent itself, steered by a page it has just read.

## What OX Security found: 17 products, four routes, most unpatched

OX Security’s research team published three documents on 15 April: an overview, a technical deep dive and a disclosure advisory.[1][2][3] It calls the issue an architectural design decision in Anthropic’s official MCP SDKs, present across Python, TypeScript, Java and Rust, rather than a coding error. It reports 150 million-plus downloads of the affected software, more than 7,000 publicly reachable servers, and more than 200 open-source projects touched; it ran commands on six live production platforms.[1]

200,000

MCP instances OX Security estimates could be taken over, as an upper bound

“Up to”, in OX’s words; the counted figure is the 7,000-plus publicly reachable servers.[1]

The advisory sorts the cases into four routes by which an attacker’s input reaches the configuration entry.[3] **Command injection through the interface** (11 products): a web console such as LangFlow, GPT Researcher, Agent Zero, Langchain-Chatchat or Fay数字人 (Fay Digital Human) lets a visitor add an “MCP server” with any command, in several cases without logging in. **Hardening bypass** (2): Flowise and Upsonic allowed only `npx` and `npm`, but those accept flags that run anything; OX’s payload was `npx -c`.[2] **Prompt injection** (1): in the Windsurf editor, a malicious web page tells the agent to edit its own `mcp.json`, with no click from the user, CVE-2026-30615. **Hidden STDIO configurations** (3): a request quietly switches a connection’s type from web to STDIO, as in DocsGPT and LettaAI.[3] Separately, OX says 9 of 11 MCP registries accepted its test package.[1]

**Figure: On the day of disclosure, 13 of the 17 products had no fix stated**

*Products in OX Security's MCP advisory by fix status, 15 April 2026*

- No fix stated13 products 76%
- Fixed (release or hosted service)3 products 18%
- Warning added, no fix1 products 6%

|  | Value (products) | Share |
| --- | --- | --- |
| No fix stated | 13 | 76% |
| Fixed (release or hosted service) | 3 | 18% |
| Warning added, no fix | 1 | 6% |

Source: OX Security, MCP supply chain advisory: RCE vulnerabilities across the AI ecosystem · as of 15 April 2026 · TechBag's tally of the advisory's 17 entries. Fixed: LiteLLM (v1.83.7-stable) in a release; DocsGPT and LettaAI on their hosted services only. Warning: Upsonic added a prompt, no fix.

TechBag countTechBag count

We counted the advisory’s entries one by one: 17 products, 14 with a CVE identifier and 3 unassigned or pending, 15 rated critical and 2 high. OX’s overview says “10 CVEs issued (and counting)” and its table prints CVE-2026-33224 against both Bisheng and Jaaz; the advisory gives Jaaz CVE-2026-30616. We use the advisory.[1][3]

## “Expected”: why the protocol will not change, and who that leaves holding it

OX asked Anthropic to change the design so that developers pre-configure the allowed commands and user input only chooses from that list.[2] According to OX, Anthropic “declined to modify the protocol’s architecture, citing the behavior as ‘expected’”, and said the STDIO model is a secure default and sanitisation is the developer’s responsibility.[1] We have no statement from Anthropic itself to set beside that account.

Anthropic was not alone. OX names 13 rejected disclosures, among them LangChain’s MCP adapters, FastMCP, AWS Labs, NVIDIA’s NeMo Agent Toolkit, Gemini CLI, Claude Code, GitHub Copilot, Cursor and Firebase Studio. The reasons given: the tool is designed to let the user run code; transport code is not liable for how developers use it; or the code already runs inside a sandbox. OX accepts the sandbox point and answers that a sandboxed attacker can still mine cryptocurrency, proxy traffic and take free compute.[3] Nor is the class new: OX lists five earlier CVEs from other researchers on the same root cause in 2025 and 2026, including MCP Inspector (CVE-2025-49596) and Cursor (CVE-2025-54136).[3]

**Figure: Sixteen months from launch to a protocol-level finding the maintainers call by design**

*MCP milestones and OX Security's disclosure, November 2024 to 15 April 2026*

| Date | Event | Detail |
| --- | --- | --- |
| Nov 2024 | Anthropic open-sources MCP | A standard to connect assistants to where data lives |
| Nov 2025 | Specification 2025-11-25 | Clients SHOULD support STDIO whenever possible |
| Dec 2025 | MCP moves to the Linux Foundation | Agentic AI Foundation; 10,000+ public servers |
| Jan 2026 | OX discloses the LangFlow flaw | Unauthenticated; all versions affected |
| Mar 2026 | LangFlow acknowledges | Inside OX's GitHub advisory report, after two months |
| Apr 2026 | OX publishes | 17 products, 13 rejected disclosures named |

Source: Anthropic (25 Nov 2024; 9 Dec 2025); MCP specification 2025-11-25; OX Security (15 Apr 2026) · as of 15 April 2026 · The LangFlow dates are the one disclosure OX dates in public; the others are not dated in its documents.

Our view

Our view: both sides are partly right, and the buyer loses either way. A local server has to be started by running something, so “by design” is literally true. But a default that is safe only if every one of thousands of projects sanitises its input correctly is not a default a company can rely on. The protocol will not save you, and most of the 17 products had not either on the day of publication. The controls therefore sit with whoever installs the agent.

## Five controls a company sets, whatever its agents run on

Each control below removes something an attack in OX’s set relied on; most are OX’s own recommendations, and none needs the protocol to change.[1]

**Figure: Every route OX documents depends on something a company can take away**

*What the attacks in OX Security's research relied on, and the control that removes each, 15 April 2026*

What the attack needed

- Any command accepted in a configuration entry
- A server process with full disk and shell access
- An AI tool’s console reachable from the internet
- A server package nobody vetted
- An outbound connection to the attacker

The control that removes it

- **Allowlist:** users pick from pre-set commands, checked with their arguments
- **Sandbox:** a container with no host disk, shell or secrets
- **No public exposure:** local servers bind to localhost; consoles behind login
- **Verified registry:** an internal approved list, pinned versions
- **Egress monitoring:** tool calls logged, unknown destinations blocked

Source: OX Security overview and technical deep dive (15 April 2026); MCP specification 2025-11-25 · as of 15 April 2026

1. **Allowlist the commands, with their arguments.** OX’s advice is to block external configuration input entirely or let it choose only “trusted pre-configured commands.”[1] Flowise is the warning: it allowed `npx` by name and was beaten by `npx -c`, so a list must fix the whole command line, not the program name.[2]
2. **Sandbox every server.** Run MCP servers in a container or virtual machine and do not give them full disk or shell access unless the job needs it.[1] Keep cloud keys and session tokens out of the sandbox, since a server that is taken over can read whatever it holds.
3. **Keep AI tool consoles off the internet.** OX found more than 915 LangFlow instances on Shodan.[2] The specification already says a local server “SHOULD bind only to localhost” and that servers “SHOULD implement proper authentication.”[6] Put admin consoles behind single sign-on or a VPN.
4. **Install only from a verified registry.** OX says to install servers only from official directories, yet 9 of 11 registries took its test package.[1] Keep an internal list of approved servers at pinned versions, and treat a new server like any new software.
5. **Watch what leaves.** Monitor tool invocations and block suspicious outbound addresses.[1] A reverse shell, a payload download and data theft all need an outbound connection; the specification already asks clients to “log tool usage for audit purposes.”[7]

Then patch what can be patched. LiteLLM is fixed in v1.83.7-stable; for products with no fix, OX’s advice is not to expose them to user input, or to switch them off until a fix ships.[1][3]

If you are buying this in India

**No Indian count exists.** OX publishes no country split for its 7,000 servers or its 200,000 estimate, and we will not invent one. What applies in India is the law on what happens after an agent is turned.

**CERT-In’s six-hour clock already covers this.** The Directions of 28 April 2022 require service providers, data centres, body corporates and government bodies to report listed incidents within six hours of noticing them. The list includes “unauthorised access of IT systems/data” and, as item xx, attacks on “systems/ servers/software/ applications related to Artificial Intelligence and Machine Learning”. The same Directions require logs of all ICT systems, kept for a rolling 180 days within India.[8] An MCP server running an attacker’s command is reportable, and the client’s log of tool calls is the evidence you will be asked for.

**DPDP adds the personal-data duty.** If the agent’s tools reach customer or employee records, Rule 6 of the DPDP Rules, notified on 13 November 2025, asks for access control, “visibility on the accessing of such personal data, through appropriate logs, monitoring and review”, and those logs kept for a year.[9] The substantive duties apply from 13 May 2027, and the 2023 Act allows a penalty of up to ₹250 crore for failing to take reasonable security safeguards.[10] Allowlisting, localhost binding and an approved-server list cost nothing in licences. If you buy sandboxing or egress filtering, compare quotes in INR inclusive of 18% GST.

How we did this

Figures as of 15 April 2026

The protocol’s behaviour is quoted from the MCP specification, version 2025-11-25 (Transports and Tools). The research findings are OX Security’s own, from its overview, technical deep dive and advisory, all dated 15 April 2026; the 200,000 figure is OX’s upper estimate and is labelled as such. The fix-status breakdown, CVE count and severity split are TechBag’s tally of the advisory’s 17 entries; “no fix stated” means the advisory gives none, not that none exists. Anthropic’s position is as OX reports it. Adoption figures are Anthropic’s. Nothing published after 15 April 2026 is used.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [OX Security, The Mother of All AI Supply Chains: critical, systemic vulnerability at the core of Anthropic's MCP](https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/) — 15 April 2026
2. [OX Security, The Mother of All AI Supply Chains: technical deep dive (STDIO payloads, LangFlow, Flowise, Windsurf)](https://www.ox.security/the-mother-of-all-ai-supply-chains-technical-deep-dive/) — 15 April 2026
3. [OX Security, MCP supply chain advisory: RCE vulnerabilities across the AI ecosystem (17 products, rejected disclosures)](https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/) — 15 April 2026
4. [Anthropic, Introducing the Model Context Protocol](https://www.anthropic.com/news/model-context-protocol) — 25 November 2024
5. [Anthropic, Donating the Model Context Protocol and establishing the Agentic AI Foundation](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation) — 9 December 2025
6. [Model Context Protocol specification, version 2025-11-25: Transports](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports) — 25 November 2025
7. [Model Context Protocol specification, version 2025-11-25: Tools](https://modelcontextprotocol.io/specification/2025-11-25/server/tools) — 25 November 2025
8. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, Annexure I, 180-day logs)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
9. [DPDP Rules, 2025, Rule 6 (reasonable security safeguards, logs kept one year)](https://dpdpa.com/dpdparules/rule6.html) — notified 13 November 2025
10. [MeitY, Digital Personal Data Protection Act, 2023 (Schedule penalties) and DPDP Rules, 2025 (substantive duties from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025

Related on TechBag: the [developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) covers the coding environments where MCP servers are most often installed; the [cloud workload security guide](https://www.thetechbag.com/browse/security/cloud-workload-security) covers the container controls behind a sandbox; the [secure web and DNS guide](https://www.thetechbag.com/browse/network-security-sase/secure-web-dns) covers the gateways that see and block outbound traffic.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) — the coding environments where MCP servers are most often installed
- [Cloud workload security guide](https://www.thetechbag.com/browse/security/cloud-workload-security) — the container controls behind a sandboxed MCP server
- [Secure web and DNS guide](https://www.thetechbag.com/browse/network-security-sase/secure-web-dns) — the gateways that see and block an agent's outbound traffic