Security researchers have uncovered a massive architectural flaw in Anthropic's Model Context Protocol, exposing millions of AI applications to remote takeovers.
“There are no sanitization warnings or roadblocks. An attacker can pass a malicious command, receive a connection error, and walk away with full control of the server.”
great and approachable way to describe this. awesome to see you cover this story!
The "Army of Juniors" framing is the sharpest insight here. MCP's design assumes every developer downstream will correctly sanitize inputs, scope credentials, and sandbox execution. That assumption was already fragile with experienced engineers. With AI coding assistants generating MCP integrations at scale, you now have thousands of implementations where neither the developer nor the AI that wrote the code questioned the security architecture underneath. The fix has to be at the protocol level. Expecting downstream developers to remember what the SDK forgot to enforce is how you get 150 million exposed downloads. Secure-by-default with explicit opt-in for dangerous modes (like the flag approach Bustan suggests) is the only pattern that scales when the majority of your integrators are AI agents themselves.
The protocol collapses PROPOSE, DECIDE, and EXECUTE into a single authority. No per-call authorization. No gate between receiving an instruction and running it. Static credentials answer "who is this client?" once at connection and then that client has the full tool surface indefinitely.
The vendor response then was the same as now: by design. The official roadmap acknowledged the gap ("deeper security and authorization work"). The question was whether the fix would land as a core spec extension or as fragmented client-side implementations.
Now OX Security has the empirical evidence: 9/11 marketplaces accepted a malicious payload without review. 6 production platforms had commands executed. 150 million downloads exposed. The architecture predicted the outcome. The outcome arrived.
You cannot patch authority collapse with input sanitization. Sanitization is a behavioral constraint that depends on every developer remembering every time. Authority separation is architectural. The system cannot execute without passing the gate. The developer does not need to remember. The architecture remembers.
“There are no sanitization warnings or roadblocks. An attacker can pass a malicious command, receive a connection error, and walk away with full control of the server.”
great and approachable way to describe this. awesome to see you cover this story!
This is what I was saying long ago. A2A, Zapier, pickle, huggingface, github. All of them are threat vectors. Zero-trust is the way.
The "Army of Juniors" framing is the sharpest insight here. MCP's design assumes every developer downstream will correctly sanitize inputs, scope credentials, and sandbox execution. That assumption was already fragile with experienced engineers. With AI coding assistants generating MCP integrations at scale, you now have thousands of implementations where neither the developer nor the AI that wrote the code questioned the security architecture underneath. The fix has to be at the protocol level. Expecting downstream developers to remember what the SDK forgot to enforce is how you get 150 million exposed downloads. Secure-by-default with explicit opt-in for dangerous modes (like the flag approach Bustan suggests) is the only pattern that scales when the majority of your integrators are AI agents themselves.
We raised this on the MCP GitHub in March.
The protocol collapses PROPOSE, DECIDE, and EXECUTE into a single authority. No per-call authorization. No gate between receiving an instruction and running it. Static credentials answer "who is this client?" once at connection and then that client has the full tool surface indefinitely.
The vendor response then was the same as now: by design. The official roadmap acknowledged the gap ("deeper security and authorization work"). The question was whether the fix would land as a core spec extension or as fragmented client-side implementations.
Now OX Security has the empirical evidence: 9/11 marketplaces accepted a malicious payload without review. 6 production platforms had commands executed. 150 million downloads exposed. The architecture predicted the outcome. The outcome arrived.
You cannot patch authority collapse with input sanitization. Sanitization is a behavioral constraint that depends on every developer remembering every time. Authority separation is architectural. The system cannot execute without passing the gate. The developer does not need to remember. The architecture remembers.
It was January lol
It blows my mind that so many companies (many that handle sensitive PII data) just call an API.