Yeah I also don't understand how this is unexpected. You gave Claude the ability to run arbitrary commands. It did that. It might unexpectedly run dangerous commands even if you don't connect it to malicious emails.

If it allows the system to be exploited in unwanted ways, it's a vulnerability. The fact that companies are marketing a giant security vulnerability as a product doesn't really change that.

It kind of is in the same way that Windows used to be root-only. This was a known issue. / vulnerability because those who understood the risks were generally smart enough to avoid getting exploited. The general population, however, did not understand this and the consequences of this became bigger and bigger.

With AI, there’s a whole class of people who don’t really know what they’re signing up for when installing these types of MCP servers. It may not be a vulnerability, but a solution is necessary.

People want to eat the cake and have it too.