Security Flaw in AI Agent Protocol Exposes 200,000 Servers to Command Execution

Quick Facts

• Security researchers found 200,000 MCP servers vulnerable to arbitrary command execution through the protocol’s default STDIO transport
• Anthropic declined to fix the flaw, stating the execution model is by design and secure by default
• The vulnerability affects major development tools including Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI

Security researchers at OX Security disclosed a critical vulnerability affecting over 200,000 servers running Anthropic’s Model Context Protocol (MCP). The flaw allows arbitrary command execution through the protocol’s default STDIO transport mechanism.

The vulnerability stems from MCP’s architectural design. The STDIO transport executes any operating system command it receives without sanitization or execution boundaries. Malicious commands run before returning error messages. The developer toolchain provides no warnings.

Four researchers at OX Security — Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok and Roni Bar — scanned the ecosystem and found 7,000 servers on public IPs with active STDIO transport. They estimate 200,000 total vulnerable instances based on extrapolation.

The vulnerability affects development tools including Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI. The research produced at least 10 CVEs rated high or critical.

Anthropic confirmed the behavior is intentional and declined to modify the protocol. The company stated the STDIO execution model represents a secure default and that sanitization remains the developer’s responsibility.

“It stops being a developer mistake and starts being a distributed failure mode when the same class of failure reproduces across that many independent implementations,” security expert Rees told VentureBeat.

The protocol has seen massive adoption since Anthropic created it as an open standard for AI agent-to-tool communication. OpenAI adopted MCP in March 2025, followed by Google DeepMind. Anthropic donated the protocol to the Linux Foundation in December 2025, with downloads crossing 150 million.

The researchers identified four attack vectors: unauthenticated and authenticated command injection via MCP STDIO, direct STDIO configuration with hardening bypass, zero-click prompt injection through MCP configuration edits, and attacks through MCP marketplaces via network requests.

Security teams successfully poisoned nine out of 11 MCP registries with test payloads and confirmed command execution on six live production platforms with paying customers. The affected marketplaces include platforms with hundreds of thousands of monthly visitors.

Several CVEs have been issued. LiteLLM (CVE-2026-30623) and Bisheng (CVE-2026-33224) received patches. Windsurf (CVE-2026-30615), which allowed zero-click local code execution, remains in reported status alongside flaws in GPT Researcher, Agent Zero, LangChain-Chatchat, and DocsGPT.

The vulnerability creates immediate compliance exposure for organizations operating under GDPR, SOC 2, or ISO 27001 frameworks. Each standard requires demonstrable controls over system access and data processing that MCP’s default configuration cannot satisfy.

According to Gartner’s 2025 cybersecurity trends report, AI-related security incidents increased 340% year-over-year, with agent-based vulnerabilities representing the fastest-growing category.

The Cloud Security Alliance independently confirmed OX’s findings and recommended organizations treat MCP-connected infrastructure as an active, unpatched threat.

Read more: 200,000 MCP servers expose a command execution flaw that Anthropic calls a feature