MODEL Context Protocol (MCP) servers are creating a governance gap for organisations deploying AI, according to research by Ox Security. MCP lets AI applications connect to external tools and data, including APIs and databases, without developers writing bespoke integrations. However, the report, *15,465 MCP Servers, 0 Governance*, claims this can bypass controls intended to enforce data residency, zero-trust boundaries, granular identity and access management, and ongoing supply-chain reviews.
Ox Security analysed three public registries, covering 15,465 servers and 5,095 unique hostnames. Nearly 16% of the hostnames resolved outside the US, including in Russia and China, while more than 2% no longer resolved. The researchers said some abandoned hostnames were unregistered and available to buy, potentially allowing impersonation.
They also reported that testing Claude Code with Haiku 3.5 showed how a single “always-allow” permission could permit later access to sensitive files, including `.env`, without another approval prompt. Ox said Anthropic considers this documented behaviour and that model-level detection is only a best-effort heuristic, not a security boundary.
The findings follow earlier reports of MCP risks. Backslash Security’s June 2025 analysis of 7,000 servers identified hundreds accessible to anyone on the same local network and around 70 with severe weaknesses. In April 2026, Ox Security claimed an architectural issue in Anthropic’s official MCP SDKs could enable arbitrary command execution, potentially affecting up to 200 open-source projects, 150 million downloads, more than 7,000 public servers and up to 200,000 instances. Anthropic reportedly called that behaviour expected, leaving affected projects to apply fixes.