Anthropic will not change MCP command execution, OX Security finds

OX Security made a report in October. It examined 15,465 public servers of MCP, the Model Context Protocol. MCP is a standard that connects AI tools to other software. About 0.45% of the servers operate on home machines, frequently through tunnel services. The report also tells that the software kits that Anthropic makes start command text as it is written.

The vulnerability

OX Security tells that the STDIO transport starts a local program. It uses a command parameter and starts it as it is written. The company names this a command injection vulnerability. An attacker can make the server start commands of the attacker.

OX Security tells that Anthropic will not change the protocol. Each developer must sanitize the input.

The numbers

• Servers examined: 15,465, from 5 registries.
• Part on home machines: about 0.45%.
• Estimate of OX Security from this year: about 200,000 servers with the vulnerability.

Safer choices

The source tells that Google Home MCP has less risk. It uses a different transport method and the OAuth sign-in standard. The MCP tool in Home Assistant is also a step up. The source warns about community projects such as ha-mcp. They can write to home parameters.

What to do

Think of a home MCP server as a network service that is open to the internet. Think that persons examine it. If access from the external internet is not necessary, stop the tunnel.