Anthropic won't own MCP 'design flaw' putting 200K servers at risk, researchers say

Ox security researchers disclosed a design flaw in Anthropic's open-source Model Context Protocol (MCP) that allows attackers to execute arbitrary OS commands and achieve full RCE across many AI frameworks, SDKs, and developer tools. The team demonstrated four vulnerability classes—including unauthenticated/authenticated command injection, hardening bypasses, zero-click prompt injection, and MCP marketplace poisoning—reported multiple CVEs and proof-of-concept exploits, and said Anthropic declined to implement a protocol-level fix, leaving large numbers of downstream projects and users at risk.