An architectural vulnerability baked into the core of Anthropic’s Model Context Protocol (MCP) exposes millions of AI applications to remote command execution. Security researchers at OX Security discovered a fundamental flaw in how the protocol handles local process execution, allowing attackers to hijack servers, exfiltrate private data, and infiltrate enterprise networks.
Because the vulnerability exists at the protocol layer, the blast radius is massive. It affects over 150 million downloads, leaves more than 200,000 public servers potentially exposed, and has resulted in over 10 Common Vulnerabilities and Exposures (CVEs). The research team successfully executed commands on six live production platforms with paying customers and bypassed security checks on 9 out of 11 major MCP marketplaces.
The vulnerability mostly remains in the wild as it is a “feature not a bug,” and requires vigilance by developers. But the report highlights the kind of care you need to put into your AI applications as you adopt new technologies.
How expected behavior turns into remote execution
To understand the scope of the threat, you have to understand the role of MCP. Released by Anthropic in November 2024, MCP acts as a universal plug adapter for AI agents. Large language models (LLMs) cannot inherently browse your local files or query a private SQL database. MCP bridges this gap. An MCP adapter translates the LLM’s requests into actions the external service such as a web search engine or a database can understand.
