2026-04-16 · 2026-Q2
Anthropic MCP Systemic STDIO Design RCE
Primary layerL5 Config
Who wrote the file that runs on open?
- Fixable
- Architectural
- Vendor response
- Not a vulnerability
- In the wild
- No
- Actor
- Attacker
Target
Anthropic Model Context Protocol reference SDKs (Python, TypeScript, Java, Rust) and 200,000+ downstream instances
Impact
Arbitrary command execution on any MCP host via STDIO transport; OX Security demonstrated takeover of six production platforms and 30+ RCE reports across projects including LiteLLM, LangChain, Flowise, GPT Researcher, Agent Zero, and Windsurf; 11 CVEs assigned to downstream projects
Root cause
MCP STDIO transport accepts arbitrary command strings and passes them to subprocess execution with no validation, sanitization, or sandboxing; commands execute even when process startup fails; Anthropic declined to modify the protocol and said sanitization is the developer's responsibility
CVEs
Sources
Catalog
Cite this: AgentProv incident record: Anthropic MCP Systemic STDIO Design RCE (2026-04-16). https://agentprov.com/incidents/2026-04-16-anthropic-mcp-systemic-stdio-design-rce
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config