200,000 MCP servers expose a command execution flaw that Anthropic calls a feature

If you’ve ever plugged a USB device into your computer and had it automatically run software, you already understand the basic problem here. A group of researchers discovered that the system most major AI companies use to let their AI assistants talk to tools on your computer will just… run whatever command it receives. No questions asked. Think of it like hiring a very capable assistant and telling them to follow any instruction they get in writing — including notes slipped under the door by strangers. The underlying system, called MCP, was built to help AI agents connect with things like your calendar, your files, or your browser. It’s become the standard plumbing behind most AI tools you might actually use. The problem isn’t obscure. It’s baked into the default setup.

Here’s the part that matters practically: this affects roughly 200,000 tools built on this standard. Anthropic’s response is essentially that this behavior is intentional — the system is designed to execute commands because that’s how it gets things done. Which is true. But “doing things” and “doing things with zero checks” are pretty different. Imagine a contractor who has full keys to your house and agrees to follow any written note they find inside, including ones your guests or strangers might have left. The capability is the same. The vulnerability is also the same.

So what does this mean for you, practically?

Save money by being more careful about which AI tools you install locally. Before adding any AI assistant plugin or agent to your computer, spend two minutes Googling the developer’s name plus “security” or “MCP.” Free tools with no clear developer behind them carry real risk right now. Avoiding one bad install could save you from a costly malware situation or data breach.

Small business owners: pause before automating anything that touches sensitive files. If someone has pitched you an AI agent that connects to your accounting software, customer database, or email, ask them specifically how it handles command execution and what sandboxing is in place. That one question will either get you a solid answer or tell you to walk away.

If you do use AI coding tools or local agents, run them in a sandbox. Tools like Docker let you create a walled-off environment on your computer where AI agents can operate without touching your real files or system. A developer friend or a quick YouTube tutorial can set this up in under an hour. It costs nothing and adds a real layer of protection.

The plumbing of AI tools is growing faster than the safety inspections, so right now, asking basic questions protects you better than any software will.