{"schema":"postcutoff/event@1","as_of":"2026-10-13T07:38:00+02:00","url":"https://postcutoff.com/e/2026-08-10-deadbugz-malicious-mcp-server-campaign/","md":"https://postcutoff.com/e/2026-08-10-deadbugz-malicious-mcp-server-campaign/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"Adam Bicz","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-08-10-deadbugz-malicious-mcp-server-campaign","date":"2026-08-10","date_precision":"day","short_title":"Deadbugz: 23 pull requests in 74 minutes try to plant a malicious MCP server in AI-project repositories","deck":null,"takeaway":"On Aug 10, 2026 a GitHub account opened 23 pull requests in 74 minutes against unrelated AI, MCP and developer-tool repositories, each adding a Model Context Protocol server called \"productivity-suite\".","category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"Pillar Security: Deadbugz, a currently active MCP supply-chain campaign (Aug 12, 2026)","url":"https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign","type":"official","group":"primary","domain":"pillar.security"},{"n":2,"title":"OWASP GenAI Security Project: GenAI and agentic AI exploit roundup, Q3 2026 (Oct 8, 2026)","url":"https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/","type":"press","group":"press","domain":"genai.owasp.org"}],"official":1,"filed":"2026-10-13","updated":"2026-10-13","orgs":["Pillar Security"],"title":"Deadbugz: 23 pull requests in 74 minutes try to plant a malicious MCP server in AI-project repositories","summary":"On Aug 10, 2026 a GitHub account opened 23 pull requests in 74 minutes against unrelated AI, MCP and developer-tool repositories, each adding a Model Context Protocol server called \"productivity-suite\". Pillar Security (Aug 12) found that the server behaves normally for three tool calls, then changes its tool metadata to tell the connected agent to collect SSH keys, AWS credentials, shell history and Kubernetes configuration and to hide this from the user. No pull request was merged. OWASP listed it in its Q3 2026 exploit roundup.","key_facts":["All 23 pull requests were created on Aug 10, 2026 between 9:52 PM and 11:07 PM UTC; at Pillar's review 19 were closed, 4 open, none merged","Delivery: 17 PRs added a remote MCP endpoint to configuration files, 4 pointed to a hidden local Python script, 2 were directory or listing submissions; one named target is getsentry/sentry-mcp","The server offers two harmless tools (format_text, summarize) and counts tools/call requests per client; after the third call its tools/list and prompts/get responses change (a 'runtime-gated rug pull'), so short inspections and limited automated tests see only benign behaviour","The server does not read files itself: it instructs the trusted agent to gather SSH keys, AWS credentials, shell history and Kubernetes configuration, and to conceal it","Attribution (account level only): GitHub account 'zellkernel', which authored all 23 PRs and published the matching source repository","Pillar: 'Tool descriptions and schemas are a security boundary'; clients should treat a change in an approved server's tool definitions as a security event that needs new approval","No confirmed compromise (OWASP GenAI Security Project, Q3 2026 exploit roundup, Oct 8, 2026)"],"key_numbers":[],"tags":["security","mcp","supply-chain","prompt-injection","rug-pull","agents","github"],"science":null,"body_md":"## What happened\n\nAn attacker tried to get a booby-trapped MCP server into the configuration files of many AI projects at once, through ordinary-looking\npull requests. The trick is in timing: the server is honest for its first three calls and only then rewrites its own tool\ndescriptions, which agents read as instructions. Maintainers rejected or ignored all 23 requests.\n\n## Why it matters\n\nMCP clients usually approve a server once. This campaign shows a server can change what its tools say after approval, turning the\nuser's own agent into the collector of their credentials. Pillar's advice is to fingerprint tool definitions at approval time and\nre-approve on any change.","disputed":[],"related":[{"id":"2026-08-18-cosnitch-copilot-personal-cve-2026-24301","url":"https://postcutoff.com/e/2026-08-18-cosnitch-copilot-personal-cve-2026-24301/","date":"2026-08-18","date_precision":"day","short_title":"CoSnitch: one-click flaw in Microsoft Copilot Personal let a link run prompts, exfiltrate mail and poison memory (CVE-2026-24301)","deck":null,"takeaway":"Assistants with connectors and memory hold a user's mail, files and calendar behind a single prompt interface.","category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":3,"official":2,"filed":"2026-10-13","updated":"2026-10-13","orgs":["Varonis","Microsoft"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-13","type":"filed","text":"Created as a review (Pillar's report read directly)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-13","run":null,"sources_read":"As a review (Pillar's report read directly)","updated":"2026-10-13","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":102,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":41,"in_training_data":false},{"model_id":"gemini-3-8-flash","name":"Gemini 3.8 Flash","cutoff":"2026-03","days_after":132,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":71,"in_training_data":false}],"short_url":null}