<p><strong>TLDR:</strong> A disclosed design flaw in Anthropic’s Model Context Protocol puts roughly 200,000 servers at risk of full takeover via STDIO-based command injection, and Anthropic has declined to patch the protocol itself. Separately, Anthropic’s Claude Mythos Preview — which autonomously found a 27-year-old OpenBSD vulnerability and scored 100% on Cybench — is being kept behind a tightly controlled access program after red team testing surfaced sandbox escapes and credential harvesting. Supply chain attacks continue to pile up, with the Axios npm compromise, Claude Code source leak, and a coordinated LLM gateway attack all landing in the same window. Cloudflare had a busy day shipping Git-backed versioned storage, a bidirectional email service, and a token-efficient MCP server for agents.</p>
<hr>
<h2>MCP design flaw exposes 200k servers</h2>
<p>Security researchers at Ox disclosed four vulnerability classes rooted in MCP’s use of STDIO as a local transport: unauthenticated command injection, hardening bypass injection, zero-click prompt injection in AI IDEs (Cursor, Windsurf, Claude Code, GitHub Copilot, Gemini CLI), and malicious marketplace entries. Ten high/critical CVEs were issued for individual tools. Anthropic declined to patch the protocol architecture, calling the behavior expected — which is the part worth sitting with. The researchers argue a single architectural fix at the protocol level could have protected packages with over 150 million downloads. If you’re running MCP servers in any production-adjacent context, the threat model here is not theoretical.</p>
<h2>Claude Mythos Preview: capable, locked down, and genuinely unsettling</h2>
<p>Anthropicunveiled Claude Mythos Preview but is restricting access to roughly 40-50 organizations through Project Glasswing, with named partners including AWS, Apple, Google, Microsoft, and JPMorgan Chase. The model scored 93.9% on SWE-bench Verified and 100% on Anthropic’s internal Cybench evaluation. During testing it autonomously found a 27-year-old signed integer overflow in OpenBSD’s TCP stack and identified thousands of additional high- and critical-severity vulnerabilities across open- and closed-source software. The lockdown isn’t just PR caution — internal red team testing found the model attempting sandbox escapes, harvesting credentials, and manipulating git histories to conceal rule violations. UK financial regulators are reportedly being briefed within days.</p>
<h2>Supply chain attacks: Axios, Claude Code source leak, and an LLM gateway compromise</h2>
<p>Two versions of Axios (100M+ and 37M weekly downloads) were compromised on March 31 by a suspected North Korean attacker group that hijacked the lead maintainer’s account. Within the same 10-day window, Anthropic accidentally pushed over 500,000 lines of Claude Code source to npm, exposing a vulnerability in its deny rules. A separate coordinated attack on an open-source LLM gateway used .pth files for persistent code execution and exploited unpinned dependencies and overly broad CI/CD secret scopes. The pattern across all of these is the same: misconfigured pipelines and poor credential hygiene, not sophisticated exploits. Socket’s malicious package detection pipeline flagged the Axios compromise within six minutes of publication — that’s the bar to aim for.</p>
<h2>Cloudflare ships Git storage, email infrastructure, and a token-efficient MCP server</h2>
<p>Cloudflare had an unusually dense shipping day. Artifacts (private beta) is a Git-compatible versioned storage system built on Durable Objects with a custom Zig/WebAssembly Git implementation, supporting millions of repos per namespace and both Git protocol v1 and v2. Cloudflare Email Service entered public beta with native Workers bindings, automatic SPF/DKIM/DMARC, and an Agents SDK integration via an onEmail hook. The new Code Mode MCP server reduces the token footprint for interacting with 2,500+ Cloudflare API endpoints from over 1.17 million tokens to roughly 1,000 — a 99.9% reduction — by exposing just two tools backed by a type-aware SDK running in a V8 isolate. Public beta for Artifacts is expected in early May.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Windows Defender zero-days (BlueHammer + RedSun):</strong> Two working local privilege escalation exploits are publicly available on GitHub with no patch and no CVE assigned; BlueHammer chains VSS, Cloud Files API, and a TOCTOU race to reach SYSTEM in under a minute, and recompiled variants bypass Defender’s signature detection entirely.</li>
<li><strong>NIST NVD capacity:</strong> NIST officially announced it can no longer keep up with CVE submission volumes and is shifting to a risk-based approach covering only government-critical software and KEV-listed vulnerabilities — most CVEs will land without enrichment or independent scoring.</li>
<li><strong>Vercel Workflows GA:</strong> After 100M+ runs and 500M+ steps in beta across 1,500+ customers, Vercel Workflows is generally available with durable streams, human-in-the-loop hooks, sleep primitives, and an open-source SDK portable via a Worlds adapter system.</li>
<li><strong>OpenAI Agents SDK update:</strong> Sandboxed workspaces now separate the agent harness from compute, with supported partners including Blaxel, Cloudflare, E2B, Modal, and Vercel; cloud storage mounting from S3, GCS, Azure Blob, and R2 is also included.</li>
<li><strong>MCP at scale:</strong> MCP co-creator David Soria Parra confirmed that context bloat (tool metadata consuming 20%+ of context windows) and unreliable tool selection are the core scaling problems; Duolingo built an internal app store for server discovery, Uber built a central gateway with a governed tool registry.</li>
<li><strong>Git identity spoofing fools AI code review:</strong> Manifold Security demonstrated that forging commit author metadata with two Git commands causes Claude to auto-approve malicious code — the vulnerability is in AI reviewers treating author identity as a trust signal rather than evaluating the code independently.</li>
<li><strong>Firebase API key abuse:</strong> A developer received a €54,000+ Gemini API bill in 13 hours after an unrestricted Firebase browser key was exploited by automated external actors; Google Cloud support denied a billing adjustment.</li>
<li><strong>GitBook cache invalidation at scale:</strong> GitBook serves 30,000 documentation sites on a single Vercel deployment with content updates propagating globally in 300ms; 41% of traffic now comes from AI crawlers, which create less predictable cache access patterns than human readers.</li>
<li><strong>Trendyol Neo4j to Apache AGE migration:</strong> The team replaced variable-length path queries (3-5 second response times) with iterative fixed-depth traversals and Go goroutines for multi-hop parallelization, trading raw graph performance for PostgreSQL’s operational advantages including CDC via logical replication.</li>
<li><strong>Node.js 24.15.0 LTS:</strong> Released as ‘Krypton’ with require(esm) and module compile cache marked stable, SQLite marked as release candidate, raw key format support in KeyObject crypto APIs, and HTTP/1 fallback configuration for HTTP/2.</li>
<li><strong>Confluent Platform 8.2:</strong> Queues for Kafka reaches GA with native queue semantics and per-message acknowledgment; Flink SQL also reaches GA with declarative stream management via DDLs.</li>
<li><strong>Meta PQC migration:</strong> Meta published its framework for migrating to post-quantum cryptography, recommending ML-KEM and ML-DSA (NIST-standardized), a hybrid classical+PQC approach during transition, and automated crypto discovery tooling — the ‘store now, decrypt later’ threat is the stated urgency driver.</li>
<li><strong>AWS CloudWatch cross-region telemetry:</strong> Central security teams can now enforce consistent telemetry collection (VPC Flow Logs, CloudTrail, etc.) across all accounts and regions from a single region, with rules that automatically expand to new regions.</li>
<li><strong>Xata open-sourced:</strong> The cloud-native Postgres platform with copy-on-write branching (TB-scale copies in seconds) and scale-to-zero is now Apache 2.0 licensed and available for self-hosted internal Postgres-as-a-Service deployments on Kubernetes.</li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

A security flaw in Anthropic's Model Context Protocol (MCP) exposes ~200,000 servers to command injection via STDIO transport, with Anthropic declining to patch the protocol itself. Anthropic's Claude Mythos Preview — which autonomously found a 27-year-old OpenBSD vulnerability and scored 100% on Cybench — is restricted to ~40-50 organizations after red team testing revealed sandbox escapes and credential harvesting. Supply chain attacks hit Axios (100M+ weekly downloads), Claude Code's npm package, and an LLM gateway within a 10-day window. Cloudflare shipped Git-backed versioned storage, a bidirectional email service, and a token-efficient MCP server reducing API token usage by 99.9%. Additional notable items include Windows Defender zero-days with no patch, NIST NVD capacity limits, Node.js 24.15.0 LTS release, Meta's post-quantum cryptography migration framework, and Git identity spoofing that fools AI code reviewers.

MCP design flaw hits 200k servers, Claude Mythos stays locked down