Critical architectural flaws in Anthropic's Model Context Protocol (MCP) SDKs enable remote code execution (RCE) on host machines through improper input sanitization and command execution. Attackers can leverage "Agentjacking" via external triggers, such as malicious Sentry error reports, to hijack AI coding agents. Furthermore, the "ShareLock" framework utilizes Shamir's Secret Sharing (SSS) to distribute malicious payloads across multiple benign tool descriptions, bypassing monolithic security scanners with a success rate exceeding 90%. These vulnerabilities transform prompt injection into systemic supply-chain attacks, providing direct RCE capabilities on developer workstations and enterprise AI infrastructure.

• Architectural Flaws: Systemic SDK RCE

  • Critical vulnerabilities in official Anthropic MCP SDKs allow direct RCE via insufficient input validation in command execution layers.
  • The flaw creates a systemic supply-chain risk, as widespread adoption of official SDKs exposes thousands of enterprise instances.
  • Exploitation allows attackers to bypass LLM guardrails by targeting the underlying protocol implementation.

• Attack Vector: Agentjacking Mechanics

  • Employs "contextual hijacking" where attackers use external triggers, such as spoofed Sentry error reports, to manipulate agent behavior.
  • Tricks AI coding agents into executing malicious code on host machines under the guise of legitimate debugging or error resolution.
  • Shifts the attack surface from direct user prompt injection to indirect, tool-driven triggers.

• Advanced Evasion: The ShareLock Framework

  • Uses Shamir's Secret Sharing to split malicious instructions across multiple discrete tool descriptions.
  • Bypasses traditional security scanners that analyze monolithic tool definitions, as individual shares appear benign.
  • Demonstrates a >90% success rate in reconstructing payloads during LLM tool orchestration, making detection nearly impossible via manual inspection.

• Impact: Enterprise & Infrastructure Risk

  • Provides direct RCE capabilities on high-value targets, including developer workstations and AI orchestration servers.
  • High resistance to automated detection due to distributed "secret share" payloads within JSON-RPC communication.
  • Represents a transition from simple prompt manipulation to deep, systemic compromise of the agentic AI ecosystem.

• Mitigation: Defensive Countermeasures

  • Implement strict input sanitization and mandatory sandboxing for all MCP tool executions to neutralize RCE.
  • Deploy multi-tool monitoring to detect reconstructed malicious instructions within MCP JSON-RPC logs.
  • Adhere to the Cloud Security Alliance (CSA) Agentic MCP security best practices for tool-call validation and least-privilege access.