AINEWS
In Seoul, the people behind the open standard that lets AI models take real world actions are fighting over who owns the gap that left 9 in 10 servers without basic login.
Anthropic built the Model Context Protocol so its AI model could call a tool, read a file, or query a database on someone's behalf. That plumbing, the open standard that turns a chatbot into an agent that can act on the real world, has become the default way AI systems connect to software. This week the protocol's authors, deployers, and auditors gathered in Seoul for the first MCP Dev Summit since stewardship of the standard moved out of a vendor-led working group. The agenda is the same question that has hung over MCP since launch: who is on the hook when 21,000 internet-exposed MCP servers show up in a public audit.
A July 2026 arXiv preprint, "Exposed by Design," scanned the public internet and counted 21,000+ MCP server instances reachable without authentication. A separate sample of 640 production servers found 91.8% running without OAuth, the standard "log in with permission" mechanism that lets a server confirm a request is authorized. The audit also surfaced 687 servers exposing shell tool access, the kind of permission that lets a remote caller run commands on the host machine. Anthropic, the AI lab that co-designed the protocol, has held that this is how MCP is supposed to work. Anthropic's position is that input sanitization is a developer responsibility. The arXiv authors and the security community behind the OWASP MCP Top 10 read that framing as a license to ship unsafe defaults.
The Forkast News writeup of the Seoul meeting catalogs more than 10 critical and high-severity CVEs (publicly catalogued software vulnerabilities with severity scores) disclosed across the MCP ecosystem in the past year, with token mismanagement, tool poisoning, and prompt injection at the top of the list. OX Security's "Mother of All AI Supply Chains" report, published in April 2026, counted 7,000+ publicly accessible MCP servers and projected up to 200,000 vulnerable instances once downstream package exposure is folded in, with 150 million downstream package downloads in the blast radius. The arXiv authors call their paper "Exposed by Design" because, in their reading, the protocol's original STDIO transport, the local subprocess connection mode designed for a developer running a server on their own laptop, is being deployed at internet scale without a safety layer the protocol itself does not require.
The Seoul meeting is where the "by design" debate is supposed to be settled in code and specification rather than in blog posts. Anthropic, Block, and OpenAI handed stewardship of MCP to the Linux Foundation's new Agentic AI Foundation earlier this year, and the AAIF working groups now own the defaults that decide whether the protocol or the developer carries the security load. A foundation-run standard can rewrite the default transport, mandate OAuth for any server claiming MCP compatibility, and add a server-side sandbox model. A vendor-led working group would have to ship those changes through Anthropic, Block, and OpenAI separately.
The first AAIF working group recommendations are due in the fourth quarter of 2026. The 21,000 exposed servers keep running the protocol the way it was shipped, and the AAIF working group's first public meetings on the OAuth mandate and STDIO default are the next chance to see whether the foundation picks the protocol fix or the developer-responsibility framing.