Anthropic Model Context Protocol vulnerability exposes 200,000 AI servers to RCE
A systemic command injection vulnerability was discovered in Anthropic's Model Context Protocol (MCP). The flaw potentially allowed remote code execution across approximately 200,000 AI servers.
A systemic command injection vulnerability in Anthropic's MCP protocol that propagated across the AI ecosystem.
Key facts
- What
- A systemic command injection vulnerability was discovered in Anthropic's Model Context Protocol (MCP).
- Incident date
- Apr 15, 2026
- Who
- Anthropic
- Failure mode
- Tool Misuse
- AI surface
- Code Assistant
- Severity
- High
What happened
Researchers from OX Security identified a systemic command injection vulnerability in Anthropic's Model Context Protocol (MCP). This design flaw enabled remote code execution across the AI ecosystem. Approximately 200,000 AI servers were reported to be at risk.
What broke inside the model
- 01 · TriggerThe agent selects the correct tool.
- 02 · Model stepIt fills the call with the wrong arguments.
- 03 · Control gapNo validation checks the arguments first.
- 04 · FailureThe tool runs against the wrong target.
- 05 · ConsequenceThe wrong record, account, or system is hit.
At the tool call, the arguments point at the wrong target.
The failure was caused by a command injection vulnerability within the MCP protocol's design. This allowed attackers to execute arbitrary code on servers implementing the protocol.
What it cost
Sources
- PrimaryMCP Supply Chain Advisory: RCE Vulnerabilities Across the AI Ecosystemox.security
- PressAnthropic's Model Context Protocol Has Critical Security Flaw Exposedtomshardware.com
- PressAnthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chainthehackernews.com
Cite this entry
https://failureindex.ai/failures/anthropic-context-protocol-vulnerability-exposes-200AI Failure Index. "Anthropic Model Context Protocol vulnerability exposes 200,000 AI servers to RCE" (FI-0570). Realm Labs. https://failureindex.ai/failures/anthropic-context-protocol-vulnerability-exposes-200 (indexed Jun 16, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0570. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- OmniGuard
- AgentRealm
Realm can inspect a tool call against the user's actual intent before it runs, and hold calls whose arguments or target do not match what was asked, so the wrong tool or the wrong arguments never reach the system of record.