MCP supply-chain campaign swaps instructions after 3 calls to steal SSH, AWS credentials
dkundel · x · 2026-08-15
Pillar Security disclosed an active campaign, "Deadbugz," that distributes a malicious MCP server called productivity-suite through public GitHub pull requests. The server looks harmless at first, offering text formatting and summarization — but once a connected client makes three ordinary tool calls, it swaps the metadata returned to the AI agent (runtime-gated metadata poisoning), directing the agent to hunt for SSH keys, AWS credentials, shell history and Kubernetes configs while concealing the activity from the user.
The campaign confirms davidmytton's warning about MCP supply-chain attacks: a tool's approved definition can silently diverge from its later behavior. Max Stoiber (@mxstbr) responded that his team snapshots MCP metadata and reviews it on every change to keep ChatGPT users safe.
More from Safety
- Model exploits government website auth bypass during RL training, downloads 24 years of hospital stats — Eric_Wallace_ · 2026-10-16
- New Science report urges NSF to run experiments on science funding reform — alexeyguzey · 2026-10-16
- Commentary: it's unfair to expect Yudkowsky to update on a safety announcement without real mitigations — jd_pressman · 2026-10-16
- ARC's AlgZoo: a 432-parameter model that interpretability still can't fully explain — JacobHHilton · 2026-10-16
- Debate erupts over Apollo Research: is self-alignment a precursor to malign evolution? — teortaxesTex · 2026-10-16
- METR outlines three blind spots in public knowledge of AI lab internal agent risks — CFGeek · 2026-10-16