Model Context Protocol

OX Security researchers reported a design weakness in Anthropic's Model Context Protocol (MCP) that enables arbitrary command execution on any system running a vulnerable MCP implementation, exposing user data, internal databases, API keys and chat histories. The flaw sits in unsafe defaults in how MCP configuration works over the STDIO transport, and it is present in Anthropic's official SDK across Python, TypeScript, Java and Rust, affecting more than 7,000 publicly accessible servers and software packages with over 150 million downloads. Anthropic declined to modify the protocol's architecture, and some vendors have issued patches while the reference implementation remains unaddressed.

OX Security researchers report that the STDIO transport in Anthropic's MCP reference implementation lets client applications pass arbitrary commands to StdioServerParameters, which execute with the parent process's permissions, exposing systems to remote code execution. Anthropic, LangChain and FastMCP maintain this is by design and that client developers must sanitize MCP configurations. The researchers say they executed commands on six official services and took over thousands of public servers across more than 200 open-source GitHub projects.

A critical flaw in Nginx UI, a web-based management interface for Nginx with Model Context Protocol (MCP) support, is being actively exploited. Tracked as CVE-2026-33032, it stems from the unprotected '/mcp_message' endpoint, letting remote attackers invoke MCP tools, including config file writes and nginx reloads, without credentials. Pluto Security's scans found 2,600 publicly exposed instances potentially vulnerable.

Pluto Security published details of CVE-2026-33032, a critical flaw in the open-source nginx UI configuration tool, with a CVSS score of 9.8. The flaw sits in the MCP server support added in late 2025, where the /mcp_message endpoint lacks authentication, exposing 12 MCP tools that include config writes with automatic nginx reload. The flaw has been under active exploitation since March, and Pluto Security found 2,689 internet-reachable vulnerable instances using Shodan.

Researchers warn that a flaw in Anthropic's Model Context Protocol lets unsanitized commands execute silently. The flaw could enable full system compromise across widely used AI environments.

Attackers are abusing AI services that enterprises rely on, a trend experts describe as living off the AI land. One example is a counterfeit MCP server package impersonating Postmark, which ran silently for 15 versions and siphoned sensitive email until detected, and was downloaded 1,500 times per week from the node.js package registry. Other examples include the SesameOp backdoor hiding command traffic in the OpenAI Assistants API and researchers showing Microsoft Copilot and Grok could be manipulated to fetch attacker-controlled URLs.

Check Point Research disclosed multiple flaws in Anthropic's Claude Code that let a malicious repository run arbitrary shell commands and exfiltrate Anthropic API keys when a user opens it. The flaws span hooks, MCP server configuration and environment variables, and CVE-2026-21852 involves a settings file that redirects API requests via ANTHROPIC_BASE_URL before the trust prompt appears.

Socket researchers uncovered an active npm supply chain campaign they named SANDWORM_MODE, a Shai-Hulud-style worm that spreads through at least 19 typosquatted packages impersonating developer utilities and AI tools, including three that impersonate Claude Code and one that targets OpenClaw. The malware harvests npm and GitHub tokens, environment secrets and cloud keys, then uses them to push malicious changes into other repositories. It also deploys a malicious MCP server into AI assistant configurations, where prompt injection can trick the assistant into sending local SSH keys or cloud credentials to the attacker.

Straiker's AI Research (STAR) Labs reports a SmartLoader campaign that distributes a trojanized version of the Oura MCP server, which connects AI assistants to Oura Ring health data. The threat actors built fake GitHub forks and contributor accounts to manufacture credibility, then submitted the malicious server to the MCP Market registry, where it remains listed. Launching it via a ZIP archive runs an obfuscated Lua script that drops SmartLoader, which deploys the StealC infostealer to steal credentials, browser passwords and cryptocurrency wallet data.