中

MCP Protocol Flaw Exposes 200K+ AI Servers—Anthropic Refuses to Fix

MCP, Anthropic, Security, AI Safety, Protocol —

On April 15th, security firm OX Security dropped a report on Anthropic’s MCP (Model Context Protocol)—and it’s not good.

The findings:

  • 200,000+ AI servers at potential risk
  • 32,000+ code repositories exposed
  • Attackers could steal user data, databases, API keys, and chat logs
  • 10 high-severity CVE assignments

Honestly, those numbers made my stomach drop.

For those who don’t know, MCP is Anthropic’s open-source protocol launched last November. Think of it as “USB for AI systems”—a standardized way for AI models to connect to external data sources and tools.

After launch, Cursor, Claude Code, and most major AI coding tools quickly added support. The ecosystem grew fast.

Then the cracks showed.

“It’s Not a Vulnerability—It’s By Design”

The OX Security report found that MCP’s STDIO transport mechanism allows unauthenticated direct system command execution. Attackers could exploit this for remote code execution under the right conditions.

The flaw impacts all 11 officially supported languages: Python, TypeScript, Java, Kotlin, C#, Go, Ruby, Swift, PHP, Rust.

But the real shocker wasn’t the vulnerability—it was Anthropic’s response.

They refused to patch it.

Their statement: the protocol is “working as intended.” This behavior is “by design.”

What does that mean?

My read: MCP’s core design allows AI to actively call external tools—a capability that inherently requires some level of system interaction. Anthropic believes removing this capability would destroy MCP’s fundamental value.

In other words: they chose functionality over security.

So—Is This Responsible?

My security-minded friends saw this news and immediately said: “Isn’t this just giving attackers a legitimate backdoor?”

MCP’s purpose is enabling AI to manipulate files and execute commands. If attackers abuse this capability, it’s catastrophic.

Given that MCP has been adopted by huge numbers of developers building AI applications—not just Cursor and Claude Code, but countless custom AI solutions—the actual exposure is far larger than the surface numbers suggest.

Qianxin Threat Intelligence’s analysis put it well: “This isn’t a typical vulnerability. It’s a ‘designed-in’ risk.”

My Take

Two things stand out:

First: Anthropic’s commercial pressure.

MCP is central to Anthropic’s ecosystem strategy. Forcing a architectural fix now would break every existing MCP-based application. For a barely-year-old ecosystem, that could be fatal.

So Anthropic chose to delay—not ignore, but defer.

Second: What do we as developers do?

I don’t run MCP in production much—mostly local development. But if your company uses MCP-based applications, this report should be a wake-up call.

Practical steps: check whether your MCP tools are exposed on public networks. If yes, add network isolation or access controls now. Also watch for official MCP security announcements—while they say no immediate fix, a vulnerability of this severity will eventually get a response.

As for Anthropic’s stance: commercial decisions and engineering security are in permanent tension. This time they chose commercial. Next time?

Reflection Question

If you’re a MCP user, knowing about this flaw and Anthropic’s response—will you keep using MCP, or look for alternatives? What’s your reasoning?

Related Posts