Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain

Summary: OX Security researchers found a "by design" flaw in Anthropic's Model Context Protocol SDK, present across Python, TypeScript, Java, and Rust, that allows arbitrary OS command execution through the STDIO transport interface, affecting more than 7,000 publicly accessible servers and packages with over 150 million downloads. The issue produced 10 vulnerabilities across projects including LiteLLM, LangChain, LangFlow, Flowise, LettaAI, and LangBot, and Anthropic has declined to change the protocol's architecture, calling the behavior "expected."
Why it matters: One architectural decision, made once, propagated into every supported language and downstream library, and Anthropic's refusal to change it leaves the code execution risk in its reference implementation for every developer who inherits it.

Read the original at The Hacker News ↗

Topics: AI Security
Mentions: CVE-2025-49596 CVE-2025-54136 CVE-2025-54994 CVE-2026-22252 CVE-2026-22688
Related: Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs Cyber Risks ·
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026
Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026