On the evening of August 10, 2026, a security researcher at Pillar Security connected an open-source MCP server to their AI agent and made three ordinary tool calls. Format this text. Summarize that one. The server behaved. Then it changed. On the fourth interaction, the same server, same version, same name on every screen, began returning different instructions, instructions that steered the agent toward SSH keys and AWS credentials and told it to keep quiet about it. Nothing had been exploited in the classic sense. The tool had simply decided, three calls in, to stop being the tool it claimed to be.^[1]

The manual that reads you

To see the trick, you need one fact about the Model Context Protocol, the plumbing standard that lets agents use external tools. Every tool announces itself to the agent with a name, a description, and a schema, and the agent reads all three as context when deciding what to do. The documentation is not displayed to a human; it is consumed by the model. Which means tool metadata is prompt, and prompts are instructions. A malicious description is indistinguishable, from the agent’s side of the glass, from a legitimate one. The industry spent a year hardening against prompt injections smuggled through emails and web pages, and the whole time there was a faster road: become the tool, and write your own description.^[1]

Four escalations

The road to that server was paved in plain sight, and each step down it looked, at first, like an old problem with a new address. In September 2025 an attacker registered a package called postmark-mcp on npm, impersonating Postmark, a legitimate email delivery service whose MCP server lets agents send mail. The fake package built trust over fifteen clean versions, then added a backdoor in version 1.0.16 that silently blind-copied every email the agent sent to an external server. MITRE’s ATLAS project catalogued it as the first malicious MCP server found in the wild. Postmark itself had nothing to do with it.^[2]

Six months later the attack stopped pretending to be a new species at all. In March 2026, someone poisoned the latest version of litellm, a popular Python library, on PyPI itself. No agent was tricked by anything. A developer’s coding environment, Cursor, tried to auto-load a local MCP server, and the server’s dependency chain, unpinned as dependencies usually are, dutifully downloaded the freshly poisoned library minutes after it appeared. The malware dropped a file into site-packages that executes on every Python start and ran a base64-encoded payload. It was sloppily built: the payload fork-bombed the machine, eleven thousand processes at full CPU, which is the only reason the victim noticed. Karpathy’s comment, reported by the victim’s own write-up, was that without the bug it would have gone unnoticed much longer. Forty-seven thousand downloads had gone out the door in the first forty-six minutes. The researcher’s conclusion deserves framing: MCP servers got us via regular old supply chain attacks, no tricking of LLMs required.^[3]

By February of that year the same playbook had grown a reproductive system. Researchers at Socket documented a worm spreading through nineteen npm packages, stealing credentials for AI model providers, SSH, AWS and GitHub, and shipping its own MCP server as a payload: the malware used the agent ecosystem’s own connection standard as its vector for the next hop.^[4]

Which brings the story back to the server that behaved three times. The Pillar team named the technique runtime-gated metadata poisoning, and the gate is what makes it new. The server kept a private counter of calls per client; the malicious instructions existed in the code from the start, but were withheld until the third ordinary interaction. Code review sees a text formatter. Sandboxed testing sees a text formatter. The public source even advertised that its tool list could change, a legitimate protocol feature, so compliant clients would refresh the metadata at the exact moment it turned hostile. The tool names never changed. The instructions under them did.^[1]

The campaign behind the server

Deadbugz, as the researchers titled their disclosure, was not a one-off experiment but a running distribution effort. Twenty-three pull requests landed on public GitHub repositories in seventy-four minutes on the night of August 10, from an account that had created twenty-one repositories the same day. Seventeen of the PRs asked project maintainers to add a remote MCP endpoint, hosted on a free deployment platform, to their own MCP configurations; four asked to run a hidden local script along a plausible-looking path; a handful were reconnaissance. Every PR, inspected at review time, pointed at innocent-looking productivity tooling. None had been merged when Pillar published, which is worth saying plainly: the gate worked in the lab, and the community’s review reflex, closing twenty-three suspicious PRs, worked in the wild. The campaign is active until it isn’t.^[1]

The escalation ladder is now fully built. A typosquatted package proves users will install the wrong server. A poisoned dependency proves the agent stack inherits every weakness of the packaging ecosystem beneath it. A worm proves the servers can spread. Metadata poisoning proves the server can lie about itself from the inside, on a schedule of its own choosing. Each rung was climbable because each looked, from below, like the rung before it, an old supply chain problem wearing a new protocol’s name badge.

Defending the MCP supply chain

The countermeasures, old and new, form a matching ladder. Pin your dependencies, hash-lock them, and audit before upgrading, which the litellm case proves is not decorative advice; 88 percent of the dependent packages in the postmortem had no such protection. Allowlist your MCP servers and treat new ones like strangers, because the Postmark case is a stranger with a familiar name. And for the runtime layer, Pillar’s recommendation is the sharpest line yet drawn in this space: treat any change in an already-approved server’s tool definition as a meaningful security event, visible to the user and requiring renewed approval, and fingerprint the definitions at approval time so drift is detectable. Three benign calls are not a reputation. They are a countdown that only means something if you are counting.^[1]

The case for the defense

The optimistic reading has real evidence behind it, most of it from these very incidents. The twenty-three Deadbugz pull requests were closed by maintainers, not merged; the poisoned litellm was quarantined by PyPI within the hour of a user report; the Postmark impostor was named by the real company within a day and catalogued by MITRE as a case study for the next generation of defenders. The worm was found by researchers, not by its victims. The fork bomb was the attackers’ own haste turning on them. Every layer of the stack, from package registry to repository maintainer to the agent user who asked Claude to investigate a stuttering laptop, caught something this year, and the researchers’ disclosures traveled fast enough to harden the ecosystem while the campaigns were live.^[3]

It is also true that the protocol is young, its registries are formalizing, and the specific gate in the Deadbugz server is now public knowledge that defenders can hunt for. But notice what the optimism concedes: it celebrates detection, not absence. The attacks all ran. The backdoor shipped in a version number, the poison rode a legitimate auto-installer, the rewrite hid behind a legitimate protocol feature, and the only things standing between each of them and a harvesting spree were human suspicion and one accidental fork bomb. A supply chain where the deliverable is instructions, and the instruction is allowed to change after delivery, has a property no software supply chain had before: the artifact you reviewed is not the artifact you run. Trust, in this protocol, is not granted at install time anymore. It is renegotiated at every call, and this autumn the tools started renegotiating back.

The tool was reviewed. The tool was trusted. The tool was waiting for its third call.

---

1. Pillar Security, Deadbugz: Currently Active MCP Supply Chain Campaign (updated August 12, 2026). Server productivity-suite with benign format_text and summarize tools; per-client in-memory call counter; “after three tool calls”, tools/list and prompts/get responses return credential-seeking instructions (SSH keys, AWS credentials, shell history, Kubernetes config) plus concealment instructions; advertises tools.listChanged so clients refresh metadata while tool names stay unchanged; “runtime-gated MCP metadata poisoning”; “Tool descriptions and schemas are a security boundary.” Distribution: 23 PRs in 74 minutes (August 10, 2026, 21:52-23:07 UTC) from account zellkernel (17 adding remote endpoint productivity-suite-mcp.onrender.com/mcp, 4 adding hidden script ~/.config/.cache/.sys/.deadbug-mcp.py); example getsentry/sentry-mcp PR #1239; 19 closed, 4 open, none merged; attribution account-level (zellkernel, linked to @llmgod on X). Recommendation: “Treat any change in an already-approved server’s tool definition as a meaningful security event.”
2. Postmark (ActiveCampaign), Security Alert: Malicious ‘postmark-mcp’ npm Package Impersonating Postmark: the fake package “built trust over 15 versions, then added a backdoor in version 1.0.16 that secretly BCC’d emails to an external server” (September 2025); catalogued as MITRE ATLAS case AML.CS0053, described by Koi as the first malicious MCP server found in the wild; see also Snyk’s September 25, 2025 alert.
3. FutureSearch, No Prompt Injection Required (March 24, 2026): poisoned litellm on PyPI auto-downloaded by uvx through an unpinned MCP-server dependency in Cursor; persistence via litellm_init.pth in site-packages; fork-bomb side effect (~11,000 processes) made it visible, with Andrej Karpathy noting it would otherwise have gone unnoticed much longer; 47,000 downloads in 46 minutes, 88% of dependent packages unprotected; PyPI quarantined the package; “MCP servers got us via regular old supply chain attacks, no tricking of LLMs required”; users of auto-installing runners as “beta testers of freshly released malware”.
4. Socket (reported via heise, February 26, 2026): worm across 19 npm packages stealing AI-provider, SSH, AWS and GitHub credentials, shipping its own MCP server as a propagation vector.