Anthropic Quietly Fixed Flaws in Its Git MCP Server that Allowed for Remote Code Execution

Why It Matters

The incident exposes how AI‑agent ecosystems expand the attack surface, forcing enterprises to secure not just individual components but the entire integration chain. It underscores the urgency for proactive, system‑wide security controls as agentic AI moves into production environments.

Key Takeaways

• Three Git MCP bugs allowed remote code execution
• Exploits required chaining with Filesystem MCP server
• Fixes released Dec 2025; update required
• Vulnerabilities stemmed from insufficient input validation
• AI agent integrations increase systemic security complexity

Pulse Analysis

The Model Context Protocol (MCP) has quickly become a backbone for modern AI‑driven development workflows, linking large language models to tools such as Git, filesystems, and APIs. By exposing natural‑language interfaces to code repositories, MCP enables products like Copilot, Claude, and Cursor to read, modify, and automate source‑code tasks. As organizations adopt these agentic pipelines, the underlying servers that bridge AI and infrastructure inherit the same security expectations as traditional services, yet they often lack mature hardening practices.

Anthropic’s recent patches address three distinct weaknesses that, when combined, form a potent remote‑code‑execution chain. CVE‑2025‑68145 allowed path‑validation bypass, letting an attacker escape repository confines. CVE‑2025‑68143 removed safeguards on the git_init tool, permitting arbitrary directory conversion into a Git repo. CVE‑2025‑68144 injected unsanitized arguments into git_diff, enabling file overwrites. By leveraging the Filesystem MCP server’s ability to write configuration files, an adversary could embed malicious smudge/clean filters, trigger them via Git operations, and run arbitrary Bash scripts. The combined exploit demonstrates how isolated component flaws can multiply risk when AI agents are orchestrated together.

The broader lesson for enterprises is clear: security assessments must move beyond single‑point evaluations to a holistic view of the agentic ecosystem. Organizations should enforce strict version control, apply patches promptly, and sandbox MCP servers with least‑privilege permissions. Continuous monitoring for anomalous Git activity, coupled with input‑validation libraries and runtime policy enforcement, can mitigate indirect prompt‑injection attacks. As AI agents become integral to software delivery pipelines, vendors and customers alike must embed security into the design of integration protocols, ensuring trust is verified rather than assumed.