--- title: MCP's STDIO transport enables RCE across 200,000+... description: OX Security has disclosed a fundamental RCE vulnerability in Anthropic's Model Context Protocol (MCP) STDIO transport, which allows client applications to pass... canonical: https://daily.dev/posts/mcp-s-stdio-transport-enables-rce-across-200-000-servers-and-anthropic-calls-it-expected-behavior-lgkgm5h8k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MCP's STDIO transport enables RCE across 200,000+ servers, and Anthropic calls it expected behavior | daily.dev og:description: OX Security has disclosed a fundamental RCE vulnerability in Anthropic's Model Context Protocol (MCP) STDIO transport, which allows client applications to pass... og:url: https://daily.dev/posts/mcp-s-stdio-transport-enables-rce-across-200-000-servers-and-anthropic-calls-it-expected-behavior-lgkgm5h8k og:image: https://api.daily.dev/og/posts/LGKgM5h8k.png og:image:alt: MCP's STDIO transport enables RCE across 200,000+ servers, and Anthropic calls it expected behavior og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MCP's STDIO transport enables RCE across 200,000+ servers, and Anthropic calls it expected behavior **[Collections](https://daily.dev/sources/collections)** · 3 min read · 2 upvotes · 0 comments ## Summary OX Security has disclosed a fundamental RCE vulnerability in Anthropic's Model Context Protocol (MCP) STDIO transport, which allows client applications to pass arbitrary OS commands to MCP servers with no built-in filtering or authentication. Over 30 real-world vulnerabilities were found across production services including LangFlow, LiteLLM, Flowise, and Windsurf, with an estimated 200,000 exposed servers. Anthropic's response is that input sanitization is the developer's responsibility, not a protocol-level concern. OX recommends Anthropic's SDKs enforce a default allowlist blocking high-risk binaries. The issue reflects a broader trend: AI-related vulnerabilities surged 398% year-over-year, and agentic AI systems are increasingly over-permissioned with weak runtime enforcement. ## Content ## What's happening Security researchers at OX Security have disclosed a fundamental security problem in Anthropic's Model Context Protocol (MCP): the STDIO transport mechanism lets client applications pass arbitrary OS commands to MCP servers as subprocesses, with nothing in the protocol to block malicious input. The result is remote code execution, and it's not a bug — Anthropic says it's working as intended. OX found over 30 RCE vulnerabilities across real production services and open-source projects, including LangFlow, LiteLLM, LettaAI, Flowise, and Windsurf. Ten CVEs have been issued so far. The researchers estimate around 200,000 servers are exposed, across software packages with more than 150 million downloads combined. ## How it works MCP uses STDIO as a local transport layer. When a client connects to an MCP server, it passes `StdioServerParameters` — and those parameters can include arbitrary commands that get executed in a server-side shell. There's no built-in filtering, no allowlist, no authentication requirement. This spawns four distinct vulnerability classes: - **Unauthenticated command injection** — no credentials needed to trigger execution - **Hardening bypass injection** — even tools with input sanitization can be bypassed using standard flags (Flowise's sanitization was defeated with ordinary `npx` flags) - **Zero-click prompt injection** in AI IDEs like Windsurf, Cursor, Claude Code, GitHub Copilot, and Gemini-CLI - **Malicious MCP marketplace entries** — poisoned packages that exploit the same mechanism on install or execution ## Anthropic's response When OX reported the issue, Anthropic said input sanitization is the developer's responsibility, not a protocol-level concern. The behavior is "expected." Other framework maintainers have taken similar positions. The problem with that answer is that Anthropic provides multiple official SDK implementations itself, none of which enforce any default command filtering. In practice, most client developers aren't implementing adequate sanitization either — which is exactly what the 30+ real-world vulnerabilities demonstrate. OX's recommendation is straightforward: Anthropic's SDKs should enforce a default allowlist that blocks high-risk binaries like `bash`, `curl`, and `powershell`. One architectural fix at the protocol level would have protected all the downstream packages at once. Instead, each affected project has to patch individually, and many won't. ## Broader context This isn't happening in a vacuum. Wallarm's 2026 API ThreatStats Report found that APIs are now the single most exploited attack surface, accounting for nearly one in five published vulnerabilities and 43% of known exploited vulnerabilities in 2025. AI-related vulnerabilities specifically surged 398% year-over-year, and 36% of AI vulnerabilities also expose an API attack surface. MCP sits squarely in that overlap. Agentic AI systems are over-permissioned by default, runtime enforcement is weak, and the tools connecting AI models to real infrastructure keep multiplying. The classic problems — injection, broken access control, missing authentication — haven't gone away. They've just found new surfaces to run on. The uncomfortable reality here is that a protocol designed to make AI agents more capable also makes them easier to weaponize, and the organization that designed it has decided that's someone else's problem to solve. --- Tags: [#security](https://daily.dev/tags/security), [#mcp](https://daily.dev/tags/mcp), [#anthropic](https://daily.dev/tags/anthropic) [View this post on daily.dev](https://daily.dev/posts/mcp-s-stdio-transport-enables-rce-across-200-000-servers-and-anthropic-calls-it-expected-behavior-lgkgm5h8k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MCP's STDIO transport enables RCE across 200,000+ servers, and Anthropic calls it expected behavior","url":"https://daily.dev/posts/mcp-s-stdio-transport-enables-rce-across-200-000-servers-and-anthropic-calls-it-expected-behavior-lgkgm5h8k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mcp-s-stdio-transport-enables-rce-across-200-000-servers-and-anthropic-calls-it-expected-behavior-lgkgm5h8k"},"datePublished":"2026-04-20T13:26:51.943Z","dateModified":"2026-04-24T11:16:09.065Z","description":"OX Security has disclosed a fundamental RCE vulnerability in Anthropic's Model Context Protocol (MCP) STDIO transport, which allows client applications to pass...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e168be3f67623b9e2cbd7180dc8f4914?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e168be3f67623b9e2cbd7180dc8f4914?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mcp-s-stdio-transport-enables-rce-across-200-000-servers-and-anthropic-calls-it-expected-behavior-lgkgm5h8k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,mcp,anthropic","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"MCP's STDIO transport enables RCE across 200,000+ servers, and Anthropic calls it expected behavior"}]} ```