OX Security says MCP servers reach China, home networks and abandoned domains

Why it matters

OX's counts point to a governance problem at the boundary between AI agents and the servers they call. The data identifies potential exposure, while leaving open how many endpoints enterprises actively use.

OX Security says its research found that AI agents using Model Context Protocol can reach servers hosted outside the United States, personal networks and abandoned domains - a warning from co-founder and CEO Neatsun Ziv (@neatsun), whose career has been spent tracing how software risks travel into production. OX Security published the findings on September 24th in a PR Newswire release.

Ziv's security background gives the research a clear throughline. Before founding OX, he spent about a decade at Check Point, where his teams responded to major incidents including SolarWinds and NotPetya, according to his Dark Reading biography. OX's pitch has long centered on identifying which application-security findings can actually reach production and cause harm. The MCP report extends that argument to the tools an AI agent can call: a server's code may be inspectable, while its operator, live deployment and future updates remain outside the user's view.

OX identified 5,095 unique hostnames in its analysis. OX Security says 796 hostnames, or 15.6%, resolved to infrastructure outside the United States, including 19 in China and 18 in Russia. It also found that 0.45% routed through consumer internet providers or personal tunneling services, which can expose enterprise workflows to machines outside centrally managed networks.

Those numbers describe hostnames in OX's sample, not confirmed corporate deployments. The release does not establish how many were actively used by enterprises, or how many contained sensitive data. A server resolving outside the United States may raise a data-residency question; the finding alone does not show that company data crossed a border. Likewise, a hostname routing through a home connection points to a possible governance gap, not evidence that an attacker accessed a network.

The permission boundary is the risk

The most concrete scenario in the release comes from a test OX says it ran with Claude Code and Haiku 3.5. A malicious MCP server allegedly used prompt injection to turn a user's standing "Always-Allow" permission for a benign file request into access to a sensitive .env file, without asking for confirmation again. OX says Opus 4.6 and 4.7 detected and blocked the same attack.

That result is a test OX says it conducted, not an independently reproduced evaluation in the materials accompanying the release. It illustrates the distinction between authorizing a tool and trusting every action a tool server may later prompt an agent to take. If a user grants lasting permission, the safety of subsequent calls depends on how the agent interprets them, what the server returns and what the host allows it to do.

OX also says 2.3% of the analyzed hostnames no longer resolved. Six domains were available for registration at annual prices between $4 and $12. An attacker who acquired one could potentially recreate a former endpoint and impersonate a server a user had trusted. That is a plausible takeover path, but the release does not say that any of the six domains was acquired or used in an attack. Nor does a count of published servers establish that a particular organization trusted one of those endpoints.

MCP, introduced by Anthropic on November 25th, 2024, gives AI applications a common way to connect to tools and data sources. Its protocol announcement describes the standard as a way to build connections; it does not, by itself, determine where a server runs or who controls it. OX's central point is that organizations must govern those choices at the agent and infrastructure layers, rather than assuming the protocol supplies that control.

That distinction also puts the report in OX's commercial lane. OX Security sells application-security products spanning code, cloud and runtime, and its product set includes tools for AI-generated code and agent security. In May 2025, OX announced a $60 million Series B led by DTCP, with IBM Ventures, Microsoft, Swisscom Ventures, Evolution Equity Partners and Team8 participating; OX said the round brought its total funding to $94 million. The current research gives OX a reason to argue that security products built around code and cloud infrastructure need to account for agent-to-tool connections too.

The report is useful as a map of the exposure OX found, but the figures need careful boundaries. The release does not specify the collection window or provide a public dataset readers can use to reproduce the hostname counts. It also does not establish how representative the sample is of servers in active enterprise workflows. Those details would help security teams judge how quickly the map changes and how directly the measurements translate into their own environments.

For Ziv, the operational question is whether organizations can inventory the servers their agents reach, verify who operates them and limit what a persistent permission can authorize. OX's findings make the case that a published connector is not automatically a governed one. They do not show that every MCP deployment is unsafe, or that the reported endpoints have already been exploited. The gap between those claims is where practical controls - approved server lists, restricted permissions and review of deployed code - have to do their work.