Anthropic and Microsoft MCP Server Vulnerabilities Highlight AI Security Risks

This week, security researchers from AI security startup Cyata reported three vulnerabilities in Anthropic’s Git MCP server, which are tracked as CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145. These vulnerabilities can be exploited through prompt injection attacks, allowing attackers to bypass safety rules and potentially execute remote code. The flaws enable unauthorized access to git repositories on the system, which could lead to sensitive data leaks. Anthropic addressed these vulnerabilities by releasing a fix in late 2025, urging organizations to update to version 2025.12.18 or later.

On the same day, BlueRock Security disclosed a server-side request forgery (SSRF) vulnerability in Microsoft’s MarkItDown MCP server, which is used for converting files to Markdown. This vulnerability allows attackers to access any HTTP or file resource by exploiting the lack of restrictions on the URI provided to the MarkItDown tool. BlueRock’s analysis found that 36.7% of over 7,000 MCP servers could be exposed to this security flaw, highlighting the widespread nature of the risk.

Understanding the Risks of MCP Servers

The Model Context Protocol (MCP) is being rapidly adopted in the AI sector, but it introduces significant security challenges. Uma Reddy from Uptycs described MCP as a ‘universal USB port for AI,’ emphasizing the supply-chain risks associated with its use. Without proper security mechanisms, developers are expected to implement best practices to secure their MCP servers, similar to securing any code execution environment.

As Jesse Griggs from Red Canary noted, the absence of built-in security in MCP is not a defect but a call to action for developers to prioritize security. The vulnerabilities in both Anthropic and Microsoft’s MCP servers illustrate the potential for serious security breaches if these protocols are not adequately secured.

Implications for Organizations

Organizations utilizing MCP servers should be aware of the risks associated with integrating AI technologies. The vulnerabilities reported not only expose sensitive data but also highlight the need for strict security measures. Security leaders must apply zero-trust principles to AI connections, ensuring that all access points are monitored and secured.

As AI technologies continue to evolve, the potential for similar vulnerabilities to emerge remains high. Organizations should regularly review their security protocols, update their software, and ensure that their AI systems are configured to minimize exposure to risks.

• CVEs in Anthropic’s Git MCP server can be exploited via prompt injection attacks, allowing unauthorized access to sensitive data.
• MarkItDown MCP server vulnerability exposes 36.7% of analyzed servers to SSRF risks, enabling access to arbitrary resources.
• Security leaders must implement zero-trust principles when integrating AI technologies to mitigate risks.
• Organizations should update to the latest versions of MCP servers to protect against known vulnerabilities.
• Regular security reviews and software updates are essential to safeguard against emerging threats in AI systems.