200000 MCP servers found exposing a command execution flaw Anthropic defends as a built in feature

Default STDIO can run OS commands with no boundary

A security audit by OX Security claims MCP’s default STDIO transport can execute arbitrary operating system commands received by an AI agent. Researchers found 7,000 publicly reachable servers and estimate 200,000 vulnerable instances, confirming impact across multiple production platforms. Anthropic says the behavior is expected by design and leaves input sanitization to developers. Security leaders warn this is a dangerous, scalable “distributed failure mode.”