In April 2026 OX Security published research titled "The Mother of All AI Supply Chains." It identified a command execution vulnerability embedded in the official MCP SDKs for Python, TypeScript, Java and Rust. The STDIO transport processed incoming configuration by passing parameters directly to the host operating system's shell without sanitization or validation. Because the SDKs sit underneath most of the ecosystem, the flaw was inherited by servers that never wrote a line of shell code.
The same month, the Cloud Security Alliance documented a critical remote code execution vulnerability in Flowise, the low-code agent builder, that required emergency patching across hundreds of production AI agent deployments.
Why it matters
Supply chain risk in agent infrastructure is not only about packages that arrive from a registry. It is about the frameworks every team builds on. When a transport in the reference SDK hands configuration to a shell, every server built on it shares the exposure, and the fix has to propagate through every downstream release. CSA's May synthesis of the incident history put it as a systemic design problem: MCP was designed for capability first, with trust boundaries added after deployment.
What to do
- 01Update every MCP server to SDK versions that carry the OX Security fix, and rebuild servers that vendor their SDK.
- 02Patch Flowise immediately if it is in production; the CSA note describes the exposure as critical.
- 03Run MCP servers on hosts with a Default Action Deny resolver policy, separate from the agents that call them.
- 04Add MCP SDKs and agent frameworks to the same dependency review and cooldown policy as application libraries.