2026 Anthropic MCP — STDIO transport / SDK design; ecosystem-wide RCE risk (Ox Security; Apr)

In April 2026, Ox Security and follow-on trade press (The Register, The Hacker News, SecurityWeek, and others) publicly documented a systemic risk in Anthropic’s Model Context Protocol (MCP) ecosystem centered on STDIO-based transports: MCP SDK patterns that spawn local subprocesses from configuration can execute attacker-supplied operating-system commands with effectively no authentication boundary at the protocol layer, enabling unauthenticated remote code execution and full host compromise when combined with malicious MCP server definitions, poisoned marketplace packages, or prompt-injection chains in AI IDEs. Researchers tied the issue to multi-language MCP SDKs (e.g., TypeScript, Python, Java, Rust) and downstream stacks such as LiteLLM, LangChain, Flowise, and similar agent frameworks—public estimates of at-risk or internet-exposed MCP-oriented deployments varied widely by measurement method (e.g., thousands versus on the order of ~200,000 instances in different summaries). Ox Security’s advisory discussed multiple coordinated CVEs across the ecosystem (including project-specific IDs for tools such as MCP Inspector, Windsurf-adjacent integrations, DocsGPT, and LiteLLM-related packages—exact identifiers evolved as vendors patched). Anthropic and some coverage characterized unsafe STDIO command invocation as partly “by design,” placing hardening responsibility on integrators; later guidance emphasized treating MCP configuration as untrusted input, restricting network exposure of MCP management surfaces, sandboxing servers, patching vendor releases, and auditing marketplace-installed STDIO server definitions. This entry indexes the disclosed vulnerability class and supply-chain response wave—not a single confirmed exfiltration of Anthropic customer account databases.