← Blog
MCP 5 min read

The mother of all AI supply chains: command injection in the official MCP SDKs

OX Security found the STDIO transport in Anthropic's Python, TypeScript, Java and Rust SDKs passing configuration to the shell unsanitized. Flowise needed an emergency patch the same month.

4
official SDKs affected: Python, TypeScript, Java, Rust
STDIO
transport that passed config to the shell
Apr 2026
Flowise critical RCE, emergency patch

In April 2026 OX Security published research titled "The Mother of All AI Supply Chains." It identified a command execution vulnerability embedded in the official MCP SDKs for Python, TypeScript, Java and Rust. The STDIO transport processed incoming configuration by passing parameters directly to the host operating system's shell without sanitization or validation. Because the SDKs sit underneath most of the ecosystem, the flaw was inherited by servers that never wrote a line of shell code.

The same month, the Cloud Security Alliance documented a critical remote code execution vulnerability in Flowise, the low-code agent builder, that required emergency patching across hundreds of production AI agent deployments.

Why it matters

Supply chain risk in agent infrastructure is not only about packages that arrive from a registry. It is about the frameworks every team builds on. When a transport in the reference SDK hands configuration to a shell, every server built on it shares the exposure, and the fix has to propagate through every downstream release. CSA's May synthesis of the incident history put it as a systemic design problem: MCP was designed for capability first, with trust boundaries added after deployment.

What to do

  1. 01Update every MCP server to SDK versions that carry the OX Security fix, and rebuild servers that vendor their SDK.
  2. 02Patch Flowise immediately if it is in production; the CSA note describes the exposure as critical.
  3. 03Run MCP servers on hosts with a Default Action Deny resolver policy, separate from the agents that call them.
  4. 04Add MCP SDKs and agent frameworks to the same dependency review and cooldown policy as application libraries.

See what your agents reached for this week

One policy in Learn Only shows every destination, with the first-seen ones held for review.