
- Anthropic's MCP Inspector project carried a flaw that allowed miscreants to steal sensitive data, drop malware
- To abuse it, hackers need to chain it with a decades-old browser bug
- The flaw was fixed in mid-June 2025, but users should still be on their guard
The Anthropic Model Context Protocol (MCP) Inspector project carried a critical-severity vulnerability which could have allowed threat actors to mount remote code execution (RCE) attacks against host devices, experts have warned.