A critical vulnerability has been discovered in a well-known artificial intelligence protocol, and Anthropic stated that it will not address the issue.

Cyber threat in the MCP protocol: what it looks like and what needs to be done

How it manifests Origin of the vulnerability Researchers at OX Security found an architectural flaw in Model Context Protocol (MCP). Affected SDK Official libraries for Python, TypeScript, Java, and Rust. Risk volume Over 150 million downloads and up to 200 thousand server instances use these SDKs. Anthropic response The company stated that the protocol “behaves as expected” and no changes are required.

What is MCP?
- An open standard introduced by Anthropic in 2024.
- Allows AI models to connect to external tools, databases, and APIs.
- Last year the protocol was transferred to Agentic AI Foundation at the Linux Foundation; it is now used by OpenAI, Google, and most AI tools.

How the vulnerability works
1. STDIO interface
- Requests are sent directly to the command execution point without additional validation.
2. Risk inheritance
- Any developer using MCP automatically inherits this weakness.

Possible exploitation paths (4 families)
No. Attack type What the attacker does 1 Code injection into UI without authorization Writes malicious code that runs automatically. 2 Bypassing protection on “protected” platforms (Flowise) Uses the vulnerability to bypass built‑in security mechanisms. 3 Malicious requests in IDE environments (Windsurf, Cursor) Executes commands without user involvement. 4 Distribution of malicious packages via MCP Publishes malware that is automatically downloaded by other users.
- Testing: researchers successfully injected payloads into 9 of 11 MCP registries and proved command execution on six commercial platforms.

Additional discovered vulnerabilities
Application CVE Status LiteLLM CVE‑2026‑30623 Closed Bisheng CVE‑2026‑33224 Closed Windsurf CVE‑2026‑30615 “Message received” (local code execution) GPT Researcher, Agent Zero, LangChain‑Chatchat, DocsGPT – same status

How Anthropic reacts
- OX Security recommendations:
- Restrict requests only from the manifest.
- Introduce a whitelist of allowed commands in the SDK.
- Company response: refusal to make changes and no objections to publishing the vulnerability.

What’s happening now
Event Current state Model leak Mythos Anthropic is conducting an internal investigation. Claude Code release Previously there was a source code leak of the service. MCP management Moved to the Linux Foundation, but Anthropic still supports the vulnerable SDK.

What developers need to do
- Until the STDIO interface is changed, implement input filtering yourself.
- Check SDK versions and update them to the latest patches if available.
- Consider implementing your own command validation mechanisms and application‑level restrictions.

In short:
The MCP vulnerability poses a serious threat to millions of users. Despite Anthropic’s refusal to change the protocol, developers must take protective measures until official fixes are released.