200,000 MCP Servers Vulnerable to Command Execution Flaw

OX Security researchers discovered a critical architectural flaw in Anthropic's Model Context Protocol, the AI agent communication standard adopted by OpenAI and Google DeepMind. The STDIO transport layer executes any operating system command it receives with no sanitization or execution boundary, meaning malicious commands run before any error is returned. Researchers scanned the ecosystem and found 7,000 servers on public IPs with STDIO transport active, estimating 200,000 total vulnerable instances. Arbitrary command execution was confirmed on six live production platforms. MCP has surpassed 150 million downloads and was donated to the Linux Foundation in December 2025.