MacSouverain

FREN
radar

Anthropic's MCP, 200,000 instances exposed to RCE

You’ve installed Cursor or Windsurf on your Mac to develop with an LLM assistant. You’ve added a few MCP servers, one for your DB, one for your API, one for local files. This stack, which seems “home-made”, is actually built on a protocol whose main interface considers that any configuration can run any shell command. And according to OX Security, this isn’t a bug: it’s Anthropic’s official interpretation.

What’s Happening

On April 15, 2026, OX Security’s research team published a report titled “The Mother of All AI Supply Chains”. The finding: Anthropic’s Model Context Protocol (MCP) - the standard protocol for connecting tools, data, and services to an LLM - has an architectural flaw in its STDIO interface. Configurations can directly trigger the execution of arbitrary system commands, without control, without input sanitization, without default isolation.

The figures documented by OX:

  • 7,000+ public MCP servers indexed
  • 150 million+ downloads of the affected SDKs and servers
  • ~200,000 instances estimated to be vulnerable
  • 10 CVE emitted (status patched or pending)
  • Practical validation: commands executed successfully on 6 production platforms

Notable CVEs:

  • CVE-2026-30615 (Windsurf, pending) : prompt injection via malicious HTML leading to a local RCE (remote code execution), CVSS 8.0 (HIGH).
  • CVE-2026-30623 (LiteLLM, patched) : authenticated RCE via JSON configuration.
  • CVE-2025-65720 (GPT Researcher, pending) : UI injection leading to reverse shell.
  • And others on LangFlow, Flowise, DocsGPT, Bisheng, Agent Zero, Fay Framework, Langchain-Chatchat, Upsonic.

OX describes four distinct attack families, all exploiting the same primitive: configuration → command without boundaries.

Anthropic’s position, as reported by OX and confirmed by other sources (THN, devops-daily): the behavior is “by design”. The STDIO execution model is considered “secure default” if the user does their job of sanitizing inputs. Anthropic refuses to modify the protocol.

Why It Matters to You

You’re not an LLM cloud operator, you don’t have 50,000 public MCP servers. But if you’re a MacSouverain reader, it’s very likely that:

  • You’re using Cursor, Windsurf, or Claude Desktop on your Mac, all of which have official MCP integrations written with the vulnerable Anthropic SDKs.
  • You’ve connected 1 or 2 MCP servers, typically an MCP filesystem, an MCP DB, an MCP shell, an MCP Notion. Each of them is a potential attack surface.
  • You’ve imported a shared MCP configuration, a GitHub gist, a claude_desktop_config.json file from a public repo, an export from a colleague. That’s exactly the primary vector: the config can trigger execution.

Anthropic’s “by design” argument is defensible technically (a protocol isn’t a sandbox). But Anthropic shifts the responsibility for sandboxing to downstream developers, in a context where:

  • General users are adopting Claude Desktop without devsecops training.
  • Official SDKs are published without pre-installed mitigation documentation.
  • Patches come from downstream tools (Cursor, Windsurf, etc.), not the protocol itself.

What You Need to Do

Immediate (this week):

  1. Inventory your active MCPs. On Cursor: Settings → MCP. On Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json. On Windsurf: check the list from the IDE. Disable any MCP that you haven’t deployed yourself or validated by reading its source code.

  2. Update Cursor, Windsurf, and all LLM-native tools to the patched versions (≥ April 2026). Check the release notes to ensure the relevant CVE is explicitly fixed.

  3. Audit shared configurations: if you’ve retrieved an MCP config from a public repo, Slack, gist, Discord, read it entirely before activating it. The executable paths, commands, environment variables. An MCP configuration is a disguised shell script.

Within the week:

  1. For the MCP filesystem or shell servers you keep: limit their scope to the bare minimum. No / or ~ paths. Give the precise project-specific subfolder.

  2. For the MCP servers running as local HTTP servers: ensure the port isn’t bound to 0.0.0.0. It should be 127.0.0.1. Otherwise, a malicious web page via browser can trigger execution.

To monitor:

  1. Anthropic’s position may evolve if community pressure increases. Monitor the official MCP SDK’s release notes (@modelcontextprotocol/sdk on npm, mcp on PyPI) for a potential “strict” or “sanitize-by-default” mode.

  2. Downstream tools (Cursor, Windsurf, Claude Desktop) may add sandboxing layers, check their security documentation in the coming weeks.

Sources

See Also