Researchers Flag RCE Risk in Anthropic Model Context Protocol

Anthropic’s open-source Model Context Protocol (MCP) contains a structural vulnerability that allows malicious actors to execute remote code on connected servers. The findings, published on April 15, by OX Security, identify a path for Remote Code Execution (RCE), a high-severity exploit that permits an attacker to run unauthorized commands on a target system without physical access.

The protocol serves as a universal bridge for AI agents to interact with external data systems and software tools. OX Security estimated the exposure covers roughly 150 million software development kit (SDK) downloads across Python, TypeScript, and Rust. Forensic testing demonstrated that a compromised MCP server could inject instructions that forced client systems to execute arbitrary code. The process left no identifiable trace in standard logs, making detection difficult for traditional monitoring tools.

“This flaw enables Arbitrary Command Execution (RCE) on any system running a vulnerable MCP implementation, granting attackers direct access to sensitive user data, internal databases, API keys, and chat histories, OX said in its report.

The firm identified approximately 200,000 vulnerable server instances globally. More than 7,000 of these remain publicly accessible. 

A Dispute Over Deployment Responsibility

Anthropic rejected the classification of the findings as a protocol-level defect. In a statement to media, a spokesperson said the observed behaviour aligned with MCP’s documented design. This design assumes that servers are either trusted by the operator or isolated within a “sandbox,” a restricted environment meant to prevent unauthorized access to the host machine.

“If an organisation deploys an untrusted MCP server without isolation, they are creating a security risk—but that risk stems from deployment practice, not a protocol flaw,” the spokesperson said. The company’s existing documentation recommends that operators validate server sources, implement network segmentation, and apply the principle of least privilege.

“We repeatedly recommended root patches to Anthropic – that would have instantly protected millions of downstream users; however, they declined to modify the protocol’s architecture, citing the behavior as “expected.” We subsequently notified Anthropic of our intent to publish these findings, to which they raised no objection,” OX researchers confirmed in the report.

The Emergence of the Universal AI Standard

Anthropic introduced the Model Context Protocol in 2025 to standardize how large language models (LLMs) call external functions and access databases. Within months, it was adopted by OpenAI and Microsoft, becoming the de-facto method for developers to build autonomous systems. The current dispute follows the March 2026 LiteLLM breach, where compromised packages targeted enterprise cloud credentials and Kubernetes clusters.

Chain Street’s Take

The MCP dispute illustrates a critical trade-off the AI industry is now facing. Infrastructure built for rapid capability often leaves security as an exercise for the end-user, but the 150-million-download footprint makes individual deployment gaps a systemic threat. 

Relying on “best practices” in a high-velocity market is a strategy that historically leads to massive data exfiltration. The industry must decide if AI infrastructure should be secure by default or if the liability for isolation remains with the developer.