#9: Three Layers, Three Attack Surfaces, One Agent

Top Story: MCP STDIO RCE — The Connector Layer Has an Authority Problem — On April 23, the Cloud Security Alliance — an independent industry research body — and OX Security, an established Israeli software-supply-chain security vendor (founded 2021, $34M seed from Insight Partners and Team8), jointly disclosed an architectural vulnerability in the Model Context Protocol's STDIO transport — the most common transport used by local MCP servers across the open-source agent ecosystem. Curator's Corner: Three Layers, Three Attack Surfaces, One Agent Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-04-27.html