Anthropic's MCP Protocol Has Architectural Flaws Leading to Server Arbitrary Code Execution

Security research team OX Security found that the AI communication protocol MCP maintained by Anthropic has architectural design flaws, which can induce servers to execute arbitrary code (RCE). The vulnerability exists in the official MCP SDK and affects all supported languages like Python and TypeScript, so all projects built on MCP are at risk.

Researchers identified four attack paths including unauthenticated UI injection and security reinforcement bypass, and found severe vulnerabilities in mainstream projects like LiteLLM, LangChain, and IBM LangFlow, with multiple CVE numbers assigned.

Anthropic refused to modify the architecture, stating the behavior was 'expected design'. The team advised users to avoid exposing AI tools to the public network, treat MCP input as untrusted data, enable sandboxes, and update software.