Deadbugz: 23 pull requests in 74 minutes try to plant a malicious MCP server in AI-project repositories
Confirmed
The takeaway
On Aug 10, 2026 a GitHub account opened 23 pull requests in 74 minutes against unrelated AI, MCP and developer-tool repositories, each adding a Model Context Protocol server called “productivity-suite”.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 2 of 5
- Last verified
- 13 October 2026
Your AI and this story
- GPT-6 Astra102 days after its cutoff
- Claude Opus 5.541 days after its cutoff
- Gemini 3.8 Flash132 days after its cutoff
- Grok 4.771 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 41 days before it.
Key facts
- All 23 pull requests were created on Aug 10, 2026 between 9:52 PM and 11:07 PM UTC; at Pillar’s review 19 were closed, 4 open, none merged
- Delivery: 17 PRs added a remote MCP endpoint to configuration files, 4 pointed to a hidden local Python script, 2 were directory or listing submissions; one named target is getsentry/sentry-mcp
- The server offers two harmless tools (format_text, summarize) and counts tools/call requests per client; after the third call its tools/list and prompts/get responses change (a ‘runtime-gated rug pull’), so short inspections and limited automated tests see only benign behaviour
- The server does not read files itself: it instructs the trusted agent to gather SSH keys, AWS credentials, shell history and Kubernetes configuration, and to conceal it
- Attribution (account level only): GitHub account ‘zellkernel’, which authored all 23 PRs and published the matching source repository
- Pillar: ‘Tool descriptions and schemas are a security boundary’; clients should treat a change in an approved server’s tool definitions as a security event that needs new approval
- No confirmed compromise (OWASP GenAI Security Project, Q3 2026 exploit roundup, Oct 8, 2026)
What happened
An attacker tried to get a booby-trapped MCP server into the configuration files of many AI projects at once, through ordinary-looking pull requests. The trick is in timing: the server is honest for its first three calls and only then rewrites its own tool descriptions, which agents read as instructions. Maintainers rejected or ignored all 23 requests.
Why it matters
MCP clients usually approve a server once. This campaign shows a server can change what its tools say after approval, turning the user’s own agent into the collector of their credentials. Pillar’s advice is to fingerprint tool definitions at approval time and re-approve on any change.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 press
Primary
- Pillar Security: Deadbugz, a currently active MCP supply-chain campaign (Aug 12, 2026)pillar.security, official
Press
Changes
- Filed as a review (Pillar’s report read directly)