Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-03-01 · source-backed
LayerX Security disclosed a CVSS 10/10 zero-click RCE affecting 10,000+ DXT users — a single malicious Google Calendar event achieves full system compromise because DXT MCP servers run with full host privileges and no sandboxing. Critically, Anthropic stated it "falls outside our current threat model." This creates a new risk category: when upstream vendors explicitly decline to patch critical vulnerabilities, builders must implement their own trust boundaries. What to do: Audit which DXT extensions have executor access. Treat any MCP connector processing external data as a potential injection vector.
Each link below shares sources, entities, or timing with this story.
Anthropic released MCP / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, Click RCE, CVSS, DXT; cite the same source (LayerX Security).
Anthropic released MCP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, Audit, CVSS, MCP; overlapping topics (compromise, full).
Anthropic released MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, CVSS, MCP, RCE; overlapping topics (anthropic, audit, cvss).
Cursor uses MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover Anthropic, Audit, MCP, Zero; overlapping topics (anthropic, audit, zero-click).
Claude Code uses MCP / Shared entities / What happened next
Linked by a graph relationship (Claude Code uses MCP); both cover Audit, CVSS, MCP, RCE; picks up the Audit thread on 2026-03-05.
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover Audit, CVSS, MCP, RCE; overlapping topics (audit, builder, category).
Anthropic released MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, Audit, CVSS, Treat; overlapping topics (claude, cvss).
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, CVSS, RCE, Treat; overlapping topics (anthropic, cvss).