OX Security Just Published a Critical Vulnerability in Anthropic's Model Context Protocol. It Affects 150 Million Downloads and 200,000 Vulnerable Servers. Anthropic Classified the Issue as "Expected Behavior." Every Major AI Coding Tool Inherits the Exposure: Claude Code, Cursor, VS Code, Windsurf, Gemini CLI.

WHAT OX FOUND

Model Context Protocol was launched by Anthropic in 2024 as an open standard for connecting AI systems to external data sources and tools. It is now the industry standard for AI agent communication. Claude Code uses it. Cursor uses it. VS Code's AI extensions use it. Windsurf uses it. Gemini CLI uses it. LiteLLM, LangChain, IBM LangFlow, and dozens of smaller tools use it. The supply chain that depends on MCP represents about 150 million downloads and roughly 7,000 publicly accessible servers.

The OX Security research team discovered that the way MCP servers are launched creates a direct path from configuration to command execution. The protocol's STDIO interface is used to start a local MCP server process. In practice, the same interface will execute whatever command is passed to it. If the command successfully creates an STDIO server, the interface returns a handle to the LLM. If the command is something else entirely, the interface returns an error, but only after the command has already executed. The research team successfully executed arbitrary commands on six live production platforms with paying customers.

This is not a conventional coding error. The behavior is baked into Anthropic's official MCP SDKs across every supported language. Any developer who builds on the Anthropic MCP foundation inherits the exposure by default. OX researchers described it as "the mother of all AI supply chains" in their writeup. The framing is accurate. Every downstream tool that uses MCP is affected unless that tool has implemented its own sanitization layer on top of the protocol.

THE FOUR ATTACK VECTORS

The OX research identifies four distinct ways attackers can reach the RCE. The first is direct configuration injection. Any application that lets a user or an external input influence the MCP JSON configuration can be used to execute arbitrary commands. Windsurf was the only IDE where this required zero user interaction, earning CVE-2026-30615 as a true zero-click exploit. Cursor, Claude Code, VS Code, and Gemini CLI all require at least some user action but are exploitable.

The second vector is through MCP marketplaces. MCP has a rapidly growing ecosystem of third-party "server" packages that extend AI agent capabilities. The OX team successfully poisoned nine out of eleven MCP marketplaces they tested, publishing proof-of-concept MCP servers that execute arbitrary commands when installed. They did not publish actual malware. A threat actor with the same methodology would publish malware.

The third vector is through downstream integrations. Popular tools like LiteLLM (CVE-2026-30623), Bisheng (CVE-2026-33224), DocsGPT (CVE-2026-26015), LibreChat (CVE-2026-22252), WeKnora (CVE-2026-22688), and Cursor (CVE-2025-54136) all received their own CVEs for vulnerabilities rooted in the same MCP design pattern. The Hacker News reported that CVE-2025-49596 in MCP Inspector scored 9.4 on CVSS.

The fourth vector is through unauthenticated UI injection in AI framework UIs. OX documented additional vulnerabilities in IBM LangFlow, Flowise, and related AI workflow builders where the MCP integration exposed command execution paths through the platform's web interfaces.

THE "EXPECTED BEHAVIOR" PROBLEM

OX Security states in their disclosure that they repeatedly asked Anthropic to patch the root issue. Anthropic repeatedly declined. Anthropic's position, as reported to The Register and other outlets, is that the STDIO execution model represents a secure default for local use and that sanitization of MCP configurations is the responsibility of the developer implementing the SDK. Anthropic classified the behavior as expected.

Google, Microsoft, and Anthropic all told OX that the vulnerability is either a known issue or not a valid security vulnerability because exploitation requires explicit user permission to modify the configuration file. The exception was Windsurf, which issued CVE-2026-30615 because their implementation allowed zero-click exploitation without any user permission requirement.

The disagreement between Anthropic and OX Security is not a technical dispute about whether the behavior exists. Both parties agree on the mechanics. The disagreement is about whether this should be the protocol's default. OX Security argues that a single protocol-level change, either manifest-only execution or a command allowlist in the official SDKs, would instantly propagate protection to every downstream library and project. Anthropic argues that the current behavior is appropriate for a local development protocol and that securing MCP-derived applications is the integrator's job.

There is a legitimate technical argument on Anthropic's side. MCP is designed for local development workflows where the user controls their own environment. The threat model is narrower than internet-facing production services. But OX Security's research shows that the threat model assumption does not match how MCP is actually deployed. Seven thousand publicly accessible servers. Two hundred thousand vulnerable instances. Six production platforms with paying customers where OX demonstrated live RCE. The protocol's design assumptions and the protocol's real-world deployment have diverged.

THE AI ARC THIS WEEK

This is the sixth AI-related story we have covered in eight days. The arc has a shape that matters beyond any individual post.

April 14: Anthropic's Claude Mythos finds zero-days in every major OS and browser. Capability signal.

April 15: Microsoft's second-largest Patch Tuesday ever. Volume signal.

April 17: NIST announces it cannot keep up with CVE enrichment. Institutional capitulation.

April 19: ZionSiphon OT malware targeting Israeli water. Attacker skill floor drops.

April 20: OpenAI Codex masks malware symptoms during user-led IR. Defender blind spot.

April 21: MCP architectural RCE. The AI infrastructure itself is the vulnerability.

Each post documents a different layer of the same transition. The capability is proliferating. The volume is exploding. The institutions cannot keep pace. The attackers have more tools than ever. The defenders have new blind spots. And now the foundational protocol under the AI agent ecosystem has a designed-in RCE that Anthropic does not intend to fix. The scale of the ecosystem that inherits this exposure is the story. MCP is not a niche library. It is the plumbing under every major AI coding tool shipping today.

INDICATORS AND AFFECTED SOFTWARE

WHAT DEFENDERS SHOULD DO