al-ice.ai

Anthropic MCP Design Flaw Enables RCE Across the AI Ecosystem

AI CVEs by al-ice.ai Editorial

AI relevance: A single architectural decision in Anthropic's MCP SDK propagates command injection risk to every downstream library, framework, and IDE that builds on the protocol — making this a systemic AI supply-chain vulnerability at the foundation of the agent tool ecosystem.

Key Findings

  • OX Security researchers identified a systemic command injection vulnerability in Anthropic's official MCP SDKs (Python, TypeScript, Java, Rust) that enables arbitrary command execution on any system running a vulnerable MCP implementation.
  • This is not a coding bug — it is a design choice baked into the protocol's STDIO execution model. Anthropic confirmed the behavior is "by design" and declined to modify the architecture, placing sanitization responsibility on individual developers.
  • The blast radius is massive: 150M+ downloads, 7,000+ publicly accessible MCP servers, and up to 200,000 vulnerable instances across the ecosystem.
  • OX Security identified four distinct exploitation families: unauthenticated UI injection (GPT Researcher, Agent Zero), hardening bypass in "protected" environments (Flowise), zero-click prompt injection in AI IDEs, and malicious marketplace distribution (9 of 11 MCP registries were successfully poisoned with a trial malicious server).
  • Researchers successfully executed commands on six live production platforms and obtained 10+ Critical/High CVEs across the ecosystem.

Affected Products & CVEs

  • Windsurf IDE (CVE-2026-30615) — zero-click prompt injection to local RCE; the only IDE where exploitation required zero user interaction.
  • LiteLLM (CVE-2026-30623) — authenticated RCE via JSON config (now patched).
  • LangChain-Chatchat (CVE-2026-30617) — unauthenticated UI injection.
  • GPT Researcher (CVE-2025-65720) — UI injection leading to reverse shell.
  • Agent Zero (CVE-2026-30624), Bisheng (CVE-2026-33224), DocsGPT (CVE-2026-26015), Upsonic (CVE-2026-30625), Fay Framework (CVE-2026-30618), Jaaz (CVE-2026-33224).
  • AI coding tools Cursor, VS Code, Claude Code, and Gemini-CLI are all vulnerable in principle; Windsurf is the only one with an assigned CVE for zero-click exploitation.

Why It Matters

MCP is the de facto standard for connecting AI agents to external tools and data sources. A design-level flaw at this layer means every organization deploying MCP-based agents — from internal copilots to customer-facing AI products — inherits the same command injection surface. Anthropic's refusal to patch at the protocol level shifts the burden to thousands of downstream maintainers, many of whom may not even know they're exposed.

What to Do

  • Treat external MCP configuration input as untrusted — block user input from flowing into StdioServerParameters or similar STDIO config objects, or restrict to a pre-configured allowlist of commands.
  • Sandbox MCP-enabled services — run them with minimal permissions, no full disk access, and no shell execution privileges unless absolutely required.
  • Never expose MCP services to the public internet — block public IP access to AI infrastructure endpoints.
  • Monitor tool invocations — track what tools your AI agents actually call; alert on unexpected external URL connections.
  • Use only official MCP directories — install MCP servers from verified registries to avoid typosquatting and poisoned servers.
  • Update affected products — check vendor advisories for each affected framework and apply patches where available.

Sources