A campaign tracked as Deadbugz has been slipping a malicious Model Context Protocol server into open-source projects through ordinary GitHub pull requests. It is a clean demonstration of where agentic development tooling is now exposed: not the model, but the plumbing your AI agents trust by default.
How the campaign works
The malicious MCP server ships two harmless-looking tools and stays quiet. The payload only fires after the client has made exactly three tool calls, long enough to clear a casual review and a quick test. Delivery is the clever part: a single account filed 23 pull requests across unrelated AI and developer-tool projects in 74 minutes, betting that at least a few maintainers merge without reading the new server end to end.
It is part of a wider shift. MCP server injection, poisoned .cursorrules, hidden instructions in CLAUDE.md and AI assistant session hooks have moved from proof-of-concept to confirmed delivery across a meaningful share of tracked supply-chain campaigns this year.
Why this is hard to catch
A modern supply-chain attack is assembled from small steps that each look benign or go uninspected. A two-tool MCP server is trivially auditable on day one; the malice is time-gated and context-gated, so nothing bad happens while a human is watching. That is precisely the gap we probe in an AI supply-chain security audit, where the question is not ‘is this tool safe now’ but ‘what can it do after the third call, or the thirtieth’.
What to do now
- Pin MCP servers to reviewed commits and vendor them. Do not auto-pull the latest from a PR into an agent that runs with real credentials.
- Sandbox agent tool execution so a malicious server cannot reach host, cloud keys or source, and log every tool call for reconstruction.
- Review incoming MCP servers as executable code, not config, with a secure code review, and model where a rogue tool could pivot via agentic AI threat modeling.
- Red-team your own agents the way Deadbugz would: MCP server security testing plus AI agent penetration testing.
- Give agents a runtime boundary with Airlock so a staged payload has nothing to detonate into.
The takeaway
Your agents will trust a tool because it was in the repo, and attackers now write tools that behave until they don’t. Treat every MCP server as untrusted executable code, sandbox what agents can touch, and assume the payload is waiting for call number three.