The surrounding ecosystem, however, has not kept pace. Earlier this year, researchers at OX Security traced critical vulnerabilities in Anthropic's MCP implementation. Their latest effort takes a much wider view, scanning 15,465 public MCP servers to understand what is actually exposed in the wild.

The takeaway from that large-scale review is that the protocol's success has run ahead of the security posture of the servers built on top of it. While the article does not name specific CVE identifiers, it points to a recurring pattern of exposed and weakly secured MCP deployments that organizations may be relying on in production agent pipelines.

Details to watch for as this research develops:

• The scope of the scan: 15,465 public MCP servers identified and examined
• The researchers involved: OX Security
• The earlier focus area: critical vulnerabilities in Anthropic's MCP implementation reported earlier this year
• The broader concern: ecosystem security lagging behind rapid protocol adoption

Teams running MCP servers should treat public exposure as a starting point for review, and keep an eye out for the full findings from OX Security for concrete indicators and remediation guidance.

Source: The Hacker News

Does your organization run any MCP servers, and have you audited what they expose?