Running Claude Code or Claude in Chrome? Here's the audit matrix for every blind spot your security stack misses

Four research teams found the same confused deputy failure in Claude across three surfaces in 48 hours. This audit matrix maps every blind spot and fix.

200,000 MCP servers expose a command execution flaw that Anthropic calls a feature

OX Security confirmed arbitrary command execution on six live platforms and estimates 200,000 MCP servers are exposed. Here's how to audit your deployments.
GitHub

test_stdio_smoke.py

These tests create a minimal index.db in a temp dir so the server starts successfully. The MCP stdio protocol uses newline-delimited JSON-RPC.
GitHub

sys_stdio_mphal.c

// objects are in a read-only module (py/modsys.c). static void stdio_obj_print(const mp_print_t *print, mp_obj_t self_in, mp_print_kind_t kind) { sys_stdio_obj_t *self = MP_OBJ_TO_PTR(self_in); ...