The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of Anthropic's MCP
· Source: ox.security
In short
OX Security Research has uncovered a critical architectural vulnerability in Anthropic's Model Context Protocol (MCP), exposing over 150 million downloads and up to 200,000 servers to remote code execution. The flaw, embedded in official MCP SDKs across Python, TypeScript, Java, and Rust, enables attackers to access sensitive user data, databases, API keys, and chat histories through four distinct attack vectors including unauthenticated UI injection and zero-click prompt injection. Despite multiple responsible disclosures and 10+ CVEs issued, Anthropic has declined to modify the protocol's architecture, citing the behavior as 'expected.'
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 16, 2026: AI-Orchestrated Automation Drives 3x Picking Efficiency, Cuts Costs 50%
Tags: MCP, vulnerability, supply-chain, security, Anthropic, RCE