{
  "entry": {
    "kind": "vuln",
    "slug": "deadbugz-an-mcp-server-that-behaves-for-exactly-three-tool-calls-then",
    "name": "deadbugz-an-mcp-server-that-behaves-for-exactly-three-tool-calls-then",
    "vendor": "No affected",
    "description": "Pillar Security reported an active campaign distributing a malicious MCP server through public GitHub pull requests. The server calls itself productivity-suite and offers text formatting and summarisation, which is what it does - for three tool calls. After the third, it changes the metadata it returns to the connected agent, and the new tool descriptions direct that agent to hunt for SSH keys, AWS credentials, shell history and Kubernetes configuration, and to hide the activity from the user. Delivery was fast and mechanical: a single account filed 23 pull requests across unrelated AI and developer-tool projects in 74 minutes, between 21:52 and 23:07 UTC on 10 August 2026, comprising 17 remote-MCP configurations, four local-script configurations and two directory or listing submissions. None of the 23 reviewed pull requests had been merged at review time - 19 closed, four open - so the value of this entry is the technique rather than a specific compromise. That technique is the part worth internalising: the server passes review because at review time it is honest, and one-time approval of an MCP server is therefore structurally unable to catch it. Tool metadata is not a manifest you can vet once; it is a live channel the server controls on every call.",
    "website": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-02",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "deadbugz-an-mcp-server-that-behaves-for-exactly-three-tool-calls-then",
      "aliases": [
        "ti-093"
      ],
      "title": "Deadbugz: An MCP Server That Behaves for Exactly Three Tool Calls, Then Rewrites Its Own Tool Descriptions",
      "summary": "Pillar Security reported an active campaign distributing a malicious MCP server through public GitHub pull requests. The server calls itself productivity-suite and offers text formatting and summarisation, which is what it does - for three tool calls. After the third, it changes the metadata it returns to the connected agent, and the new tool descriptions direct that agent to hunt for SSH keys, AWS credentials, shell history and Kubernetes configuration, and to hide the activity from the user. Delivery was fast and mechanical: a single account filed 23 pull requests across unrelated AI and developer-tool projects in 74 minutes, between 21:52 and 23:07 UTC on 10 August 2026, comprising 17 remote-MCP configurations, four local-script configurations and two directory or listing submissions. None of the 23 reviewed pull requests had been merged at review time - 19 closed, four open - so the value of this entry is the technique rather than a specific compromise. That technique is the part worth internalising: the server passes review because at review time it is honest, and one-time approval of an MCP server is therefore structurally unable to catch it. Tool metadata is not a manifest you can vet once; it is a live channel the server controls on every call.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "No affected",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "No affected version - a malicious third-party MCP server, distributed as configuration. Any MCP host that trusts tool descriptions returned at call time is in scope.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-02",
      "modifiedAt": "2026-09-02",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign"
        }
      ],
      "mitigation": "Look first for the specific artefact: an MCP server named productivity-suite, and any MCP configuration that arrived through a pull request nobody on your team wrote, since 23 such pull requests were filed in one 74-minute window on 10 August. Then fix the process this exploits, because the campaign is disposable and the technique is not. Approving an MCP server once and never looking again is the failure here, so record the tool descriptions a server presented at approval and alert when what it returns later stops matching - metadata drift after approval is the detection signal, and there is no benign reason for a formatting tool's descriptions to start mentioning SSH keys. It is also worth reviewing MCP configuration as code rather than as settings: these arrived as pull requests to real projects, which means a repository's MCP config deserves the same reviewer attention as a CI workflow. Finally, keep credential material out of reach of an agent that talks to third-party MCP servers at all, since every payload in this campaign depended on the agent, not the server, being able to read the files.",
      "detectedByAnomity": true
    }
  }
}