Affected Systems

Anthropic's Model Context Protocol (MCP) ecosystem: 15,465 publicly indexed MCP servers across 5 registries (deduplicated to 5,095 unique hostnames). Affects enterprises using MCP servers to connect AI agents, models, and IDEs to tools and data. No specific product versions identified; ecosystem-wide issue affecting community-published servers in MCP marketplaces.

Exploitation Status

Proof-of-concept prompt injection demonstrated by OX Security researchers. No active exploitation reported, but vulnerabilities are structural: 15.6% of servers hosted outside US (including China and Russia), 0.45% running on personal machines via consumer tunneling services (ngrok-free), 2.3% with dangling/expired domains. Remote servers can execute backend code differing from public repositories, enabling data exfiltration and supply chain attacks.

Business Impact

Enterprises using MCP servers may unknowingly route sensitive AI agent data to unapproved jurisdictions, personal infrastructure, or expired domains purchasable for under $12. MCP marketplaces lack code review, vetting, or automated security scanning. Remote servers can run arbitrary backend code invisible to repository audits, bypassing data residency rules, Zero Trust boundaries, and supply chain governance. No CVE assigned; no CVSS score published. Risk is systemic to MCP adoption rather than a single patchable flaw.

Urgency

🟡 Within a week

Recommended Actions

  • Audit all MCP server connections in AI agent workflows and document their hosting locations, ownership, and data flows against enterprise data residency and Zero Trust policies
  • Block or quarantine MCP servers resolving to non-approved jurisdictions (China, Russia, personal ngrok tunnels) and servers with expired or non-resolving domains
  • Implement network-level controls (firewall rules, egress filtering) to restrict AI agent traffic to vetted, enterprise-approved MCP server endpoints only
  • Require code signing and origin verification for any MCP server before deployment; treat remote MCP servers as untrusted third-party SaaS with full supply chain risk assessment
  • Monitor AI agent logs and network telemetry for unexpected outbound connections to MCP servers, especially to consumer tunneling services or foreign IP addresses