Gate News message, April 21 — Security firm OX Security has disclosed a design-level remote code execution (RCE) vulnerability in MCP (Model Context Protocol), the open standard for AI agents to invoke external tools, which is led by Anthropic. Attackers can execute arbitrary commands on any system running a vulnerable MCP implementation, gaining access to user data, internal databases, API keys, and chat histories.
The flaw stems not from implementation errors but from default behavior in Anthropic’s official SDK when handling STDIO transport—affecting Python, TypeScript, Java, and Rust versions. The StdioServerParameters in the official SDK directly launches subprocesses based on configuration command parameters; without additional input sanitization by developers, any user input reaching this stage becomes a system command. OX Security identified four attack vectors: direct command injection via configuration interfaces, bypassing sanitization with whitelisted command flags (e.g., npx -c ), prompt injection in IDEs to rewrite MCP configuration files for tools like Windsurf to run malicious STDIO services without user interaction, and injecting STDIO configurations through HTTP requests in MCP marketplaces.
According to OX Security, affected packages have been downloaded over 150 million times, with 7,000+ publicly accessible MCP servers exposing up to 200,000 instances across 200+ open-source projects. The team submitted 30+ responsible disclosures, resulting in 10+ high-severity or critical CVEs covering AI frameworks and IDEs including LiteLLM, LangFlow, Flowise, Windsurf, GPT Researcher, Agent Zero, and DocsGPT; 9 of 11 tested MCP package repositories could be compromised using this technique.
Anthropicresponded that this is “by design,” calling STDIO’s execution model a “secure default design,” and shifted input sanitization responsibility to developers, refusing to modify the protocol or official SDK. While DocsGPT and LettaAI have released patches, Anthropic’s reference implementation remains unchanged. With MCP becoming the de facto standard for AI agents accessing external tools—followed by OpenAI, Google, and Microsoft—any MCP service using the official SDK’s default STDIO approach could become an attack vector, even if developers write error-free code.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Taiwan banks team up to build local AI! Finance’s large language model goes live by the end of the year at the fastest
CITIC Financial Holding, led by CITIC Financial Holding’s 16 financial institutions, announced the launch of the “Financial Large Language Model FinLLM” project. The first release of the banking model is expected to be published in August, and in 2026 Q1, AI agents based on FinLLM will be introduced. Training will begin in May, with a budget of approximately 40–70 million yuan. Due to regulatory and localization needs, local data training will be the core, strengthening sovereign AI, building shared infrastructure, and extending to inclusive finance. The plan has been incorporated into the national AI development plan and has received cross-ministry support.
ChainNewsAbmedia17m ago
Google CEO: Capital expenditures in 2026 will reach $185 billion; ramping up investment in the era of AI agents
Google CEO Sundar Pichai announced at Google Cloud Next in Las Vegas on April 22 that Google plans to invest $175 billion to $185 billion in 2026 in capital expenditures to build the infrastructure needed for autonomous AI agents, up from $31 billion in 2022.
MarketWhisper53m ago
Google Jules releases a new version candidate list, repositioning it as an end-to-end product development platform
According to the official April 23 announcement by the Google Jules team, Jules’s product positioning has been upgraded from an asynchronous coding agent to an “end-to-end agentic product development platform.” The new version can read the full product context, independently determine the next steps for building, and submit a PR. The official also announced that the new version candidate list is now open.
MarketWhisper58m ago
Google Jules Rebrands as End-to-End Agentic Product Development Platform, Opens Waitlist for New Version
Gate News message, April 23 — Google's Jules team announced the opening of a waitlist for a new version of the product, repositioning Jules from an asynchronous coding agent to an end-to-end agentic product development platform. According to the official description, the upgraded platform reads enti
GateNews1h ago
Perplexity Discloses Web Search Agent Post-Training Method; Qwen3.5-Based Model Outperforms GPT-5.4 on Accuracy and Cost
Perplexity uses SFT followed by RL with Qwen3.5 models, leveraging a multi-hop QA dataset and rubric checks to boost search accuracy and efficiency, achieving best-in-class FRAMES performance.
Abstract: Perplexity's post-training workflow for web-search agents combines supervised fine-tuning (SFT) to enforce instruction-following and language consistency with online reinforcement learning (RL) via the GRPO algorithm. The RL stage uses a proprietary multi-hop verifiable QA dataset and rubric-based conversational data to prevent SFT drift, with reward gating and within-group efficiency penalties. Evaluation shows Qwen3.5-397B-SFT-RL achieving top FRAMES performance, 57.3% accuracy with a single tool call and 73.9% with four calls at $0.02 per query, outperforming GPT-5.4 and Claude Sonnet 4.6 on these metrics. Pricing is API-based and excludes caching.
GateNews2h ago
OpenAI Codex Team Fixes OpenClaw Authentication Bug, Significantly Improves Agent Behavior
OpenClaw switches from Pi to Codex harness to fix a silent authentication fallback, with two PRs addressing the bridge and fallback; post-fix, the agent shifts from shallow heartbeat polling to a full work loop, enabling progress.
Abstract: OpenClaw’s Codex harness optimization addressed a critical authentication flaw that caused silent fallback to the Pi harness when using Codex with OpenAI models. Two pull requests fix the authentication bridge and prevent silent fallback, changing the runtime adapter. As a result, agent behavior evolves from shallow heartbeat polling to a full work loop that reads context, analyzes tasks, edits repositories, and verifies progress, improving continuity and visibility across heartbeats.
GateNews3h ago
