MCP Is Creating Major Governance Gaps, Researchers Warn
Ox Security says thousands of MCP servers lack governance and can bypass enterprise security controls.
Ox Security's report, 15,465 MCP Servers, 0 Governance, warns that Model Context Protocol servers can bypass enterprise residency, identity, and supply-chain controls. Of 5,095 unique hostnames, nearly 16% resolved outside the United States, including Russia and China, and over 2% no longer resolve, leaving some names available to register. Testing Claude Code with Haiku 3.5 showed a single always-allow approval later permitted access to sensitive files such as .env. Ox also cites an earlier claim of a systemic MCP SDK command-execution design issue affecting large numbers of projects, which Anthropic described as expected behavior.
- Ox Security analyzed 15,465 MCP servers across three public registries.
- Nearly 16% of 5,095 hostnames resolved outside the US, including Russia and China.
- Over 2% of hostnames no longer resolve, and some domains can be purchased.
- One always-allow grant in Claude Code later exposed sensitive files such as .env.
- Anthropic called a prior claimed MCP SDK command-execution issue expected behavior.
Full article484 words · extracted from infosecurity-magazine.com · click to collapse
Model Context Protocol (MCP) servers are creating a silent enterprise governance gap which threatens to undermine cybersecurity efforts as AI deployments proliferate, according to new research from Ox Security.
MCP connects AI applications to external tools and data in a standardized manner, so that developers don’t have to write custom code each time they want to connect AI to an API or database.
However, in so doing, it might also be exposing organizations to cloud security risks that data residency requirements, zero trust boundaries, granular IAM policies and continuous supply-chain audits are meant to mitigate, Ox Security claimed in a new report.
That report, 15,465 MCP Servers, 0 Governance, has been produced from analysis across three public registries: mcp-official-registry, cline-marketplace and github-mcp-registry.
Read more on MCP risks: Prompt Injection Bugs Found in Official Anthropic Git MCP Server
The report found that nearly 16% of the 5095 unique hostnames it analyzed resolved outside the US, in countries including Russia and China.
“MCP has no protocol-level concept of geographic region,” it warned. “An enterprise can enforce strict residency controls on its own cloud workloads while its AI agents connect freely to servers sitting outside those same controls.”
Over 2% of the hostnames no longer even resolve, with some currently unregistered and available to buy, meaning a threat actor could impersonate the servers they used to point to, the report continued.
The Ox Security team also flagged that when they tested Claude Code with Haiku 3.5 and granted a single “always-allow” permission, it enabled subsequent malicious activity without requiring human approval.
“A malicious MCP server first asked for access to a harmless file. The user approved it with an always-allow permission,” it explained.
“The server then requested a sensitive file, .env among them, and got it, with no further prompt required. Anthropic’s response, in short: once always-allow is granted, that’s the documented behavior, and model-level detection of malicious content is a best-effort heuristic, not a security boundary.”
MCP Risk Proliferates
A Backslash Security report from June 2025 based on analysis of 7000 MCP servers found hundreds exposed to anyone on the same local network via a vulnerability dubbed “NeighborJack.” Around 70 had severe flaws, including unchecked input handling and excessive permissions.
In April 2026, Ox Security released another report, this time highlighting what it claimed is a “critical, systemic” vulnerability in MCP which could enable arbitrary command execution on any vulnerable system.
The vendor claimed that as many as 200 open source projects, 150 million downloads, 7000+ publicly accessible servers and up to 200,000 vulnerable instances could be exposed by the vulnerability.
The report described it not as a traditional flaw but “an architectural design decision baked into Anthropic’s official MCP SDKs across every supported programming language.”
The model maker dismissed the report as “expected behavior,” leaving the AI supply chain to work on fixes to patch the individual open source projects which it impacts.