---
id: "2026-08-10-deadbugz-malicious-mcp-server-campaign"
url: "https://postcutoff.com/e/2026-08-10-deadbugz-malicious-mcp-server-campaign/"
as_of: "2026-10-13T07:38:00+02:00"
date: "2026-08-10"
date_precision: day
category: policy-safety
importance: 2
confidence: high
status: [Confirmed]
sources: 2
editor: Adam Bicz
human_review: null
version: null
---

As of: 2026-10-13 07:38 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code). Human editor: Adam Bicz.
Canonical page: https://postcutoff.com/e/2026-08-10-deadbugz-malicious-mcp-server-campaign/

# Deadbugz: 23 pull requests in 74 minutes try to plant a malicious MCP server in AI-project repositories

On Aug 10, 2026 a GitHub account opened 23 pull requests in 74 minutes against unrelated AI, MCP and developer-tool repositories, each adding a Model Context Protocol server called "productivity-suite". Pillar Security (Aug 12) found that the server behaves normally for three tool calls, then changes its tool metadata to tell the connected agent to collect SSH keys, AWS credentials, shell history and Kubernetes configuration and to hide this from the user. No pull request was merged. OWASP listed it in its Q3 2026 exploit roundup.

## Key facts
- All 23 pull requests were created on Aug 10, 2026 between 9:52 PM and 11:07 PM UTC; at Pillar's review 19 were closed, 4 open, none merged
- Delivery: 17 PRs added a remote MCP endpoint to configuration files, 4 pointed to a hidden local Python script, 2 were directory or listing submissions; one named target is getsentry/sentry-mcp
- The server offers two harmless tools (format_text, summarize) and counts tools/call requests per client; after the third call its tools/list and prompts/get responses change (a 'runtime-gated rug pull'), so short inspections and limited automated tests see only benign behaviour
- The server does not read files itself: it instructs the trusted agent to gather SSH keys, AWS credentials, shell history and Kubernetes configuration, and to conceal it
- Attribution (account level only): GitHub account 'zellkernel', which authored all 23 PRs and published the matching source repository
- Pillar: 'Tool descriptions and schemas are a security boundary'; clients should treat a change in an approved server's tool definitions as a security event that needs new approval
- No confirmed compromise (OWASP GenAI Security Project, Q3 2026 exploit roundup, Oct 8, 2026)

## What happened

An attacker tried to get a booby-trapped MCP server into the configuration files of many AI projects at once, through ordinary-looking
pull requests. The trick is in timing: the server is honest for its first three calls and only then rewrites its own tool
descriptions, which agents read as instructions. Maintainers rejected or ignored all 23 requests.

## Why it matters

MCP clients usually approve a server once. This campaign shows a server can change what its tools say after approval, turning the
user's own agent into the collector of their credentials. Pillar's advice is to fingerprint tool definitions at approval time and
re-approve on any change.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 102 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 41 days after its cutoff
- Gemini 3.8 Flash (training cutoff March 2026): 132 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 71 days after its cutoff

## Sources

1. [Pillar Security: Deadbugz, a currently active MCP supply-chain campaign (Aug 12, 2026)](https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign) (pillar.security, official)
2. [OWASP GenAI Security Project: GenAI and agentic AI exploit roundup, Q3 2026 (Oct 8, 2026)](https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/) (genai.owasp.org, press)

## Changes

- 2026-10-13 (filed): Created as a review (Pillar's report read directly)

## Related

- 2026-08-18: [CoSnitch: one-click flaw in Microsoft Copilot Personal let a link run prompts, exfiltrate mail and poison memory (CVE-2026-24301)](https://postcutoff.com/e/2026-08-18-cosnitch-copilot-personal-cve-2026-24301/index.md)