2026-04-16 · 2026-Q2
Anthropic MCP Systemic STDIO Design RCE
PrimaryL5Config
- Fixable:
- No, architectural
- Vendor response:
- Not a vulnerability
- In the wild:
- No
- Actor:
- Attacker
Target
Anthropic Model Context Protocol reference SDKs (Python, TypeScript, Java, Rust) and 200,000+ downstream instances
Impact
Arbitrary command execution on any MCP host via STDIO transport; OX Security demonstrated takeover of six production platforms and 30+ RCE reports across projects including LiteLLM, LangChain, Flowise, GPT Researcher, Agent Zero, and Windsurf; 11 CVEs assigned to downstream projects
Root Cause
MCP STDIO transport accepts arbitrary command strings and passes them to subprocess execution with no validation, sanitization, or sandboxing; commands execute even when process startup fails; Anthropic declined to modify the protocol and said sanitization is the developer's responsibility