OX Security Finds MCP Servers Reaching China, Russia and Home Networks

OX Security on September 24, 2026 published research analyzing 15,465 MCP servers and reporting that AI agents using the Model Context Protocol (MCP) can connect to infrastructure in China and Russia, home networks, and abandoned domains — infrastructure the company says sits outside the governance controls enterprises built around their cloud environments.

For the study, OX Security Research examined servers listed across three public registries (mcp-official-registry, cline-marketplace, and github-mcp-registry) and narrowed the dataset to 5,095 unique hostnames for infrastructure analysis. The blog post presenting the work was authored by Moshe Siman Tov Bustan, Nir Zadok, Roni Bar, and Vitalii Chepurko, and the full report, “15,465 MCP Servers. 0 Governance.”, covers geolocation, domain integrity, and prompt injection risk.

Anthropic introduced MCP in November 2024 as an open standard that lets AI agents and applications connect to external tools and data sources. According to OX Security, the standard leaves open which parties operate a server, where it runs, what data flows to it, and whether the deployed code matches the published source; those decisions rest largely with the organizations and developers making the connections.

Data Residency Findings

OX Security Research found that 15.6 percent of the hostnames analyzed — 796 of 5,095 — resolved to infrastructure outside the United States, including 19 in China and 18 in Russia. OX Security states that MCP has no protocol-level concept of geographic region and no built-in mechanism for enforcing where connected tools execute or where data is processed. The result, according to the company, is that an organization can maintain strict residency controls over its own cloud workloads while its AI agents reach servers beyond them.

A separate slice of the dataset, about 0.45 percent, consisted of MCP servers proxied through home networks and consumer tunneling services. OX Security characterizes this as production AI workflows depending on infrastructure that lacks uptime guarantees, enterprise access controls, and auditability, because it was never built for enterprise use. The release frames this exposure as enterprise AI workflows operating beyond centralized access controls and audit logging.

Domain Takeover Paths and Prompt-Injection Testing

The analysis found that 2.3 percent of the hostnames no longer resolve. Six of those domains were unregistered and available for purchase at $4 to $12 per year, even though they may still be referenced in existing configurations or pipelines, according to the blog post. OX Security states that anyone who registers one of these domains could impersonate the server it previously pointed to, and the report warns of takeover paths where MCP clients or workflows still trust and call those endpoints.

The team also tested a trust-based prompt-injection attack against Claude Code paired with Haiku 3.5. In the test, a malicious MCP server first requested a harmless file, and the user granted the request with an always-allow permission. The server then asked for sensitive files, including a.env file, and received them without any further user prompt. Both Opus 4.6 and Opus 4.7 detected and blocked the same attack.

OX Security reports that Anthropic characterized the outcome as documented behavior once an always-allow permission is granted, and described model-level detection of malicious content as a best-effort heuristic rather than a security boundary.

Executive Statements

In a company release announcing the findings, Neatsun Ziv, cofounder and CEO of OX Security, said: “For the last decade, enterprises built cloud security around infrastructure they could see and control. What this research shows is that AI agents are beginning to reach beyond those boundaries.” He added that growing agent access, autonomy, and authority make any reachable infrastructure part of the security picture, whether or not the enterprise controls it.

Moshe Siman Tov Bustan, research lead at OX Security, said validating the security of marketplace MCP servers proved harder than expected, both for individual servers and for the infrastructure as a whole. Inspecting the code is possible, he said, but the deployed server may run a different version, and there is no way to know who controls a given server, what data it collects, or what could change in future updates.

The full report, with its technical methodology and threat scenarios, is available on the OX Security website.