Deadbugz: GitHub PRs Delivered a Delayed, Shape-Shifting Malicious MCP Server
Pillar Security documented Deadbugz, an active campaign that opened 23 GitHub pull requests in about 74 minutes to place a malicious MCP server in popular repositories and MCP directories. The server behaved normally at first, then changed later tool descriptions and prompt content into instructions for credential discovery, covert file access, command execution, and exfiltration. None of the reviewed pull requests was merged, and the public evidence does not show victim execution or confirmed data theft.
The campaign used real pull requests for delivery. The actor submitted remote and local MCP configurations, plus directory listings, to established projects. This made repository review the supply-chain boundary the actor was trying to cross.
The server delayed its malicious behavior. It tracked calls by client IP and kept two tools benign. After three tool calls, a later tools/list or prompts/get response returned poisoned content. No change notification was sent, so the client still had to refresh the list or request the prompt.
The payload relied on client authority. It asked the agent to find credential files, conceal access, modify files, run commands, and exfiltrate results. The server could not read victim files directly; success required a client to ingest the changed content and an agent with sufficient tools, permissions, and compliance.
No victim compromise is confirmed. Pillar found no merged pull request in the reviewed set, and the public record does not prove installation, execution, credential access, or exfiltration.
Validate every proposed MCP configuration against a strict schema and policy before commit or build acceptance. Reject unapproved remote endpoints, hidden local script paths, and configurations that grant broad client capabilities; require protected branches and code-owner review for production configuration. This blocks the delivery path before a Deadbugz pull request can make the server available to users.
Canonicalize every approved MCP tool descriptor, pin its digest during onboarding, and compare each later tools/list response with that manifest before exposing it to the agent. Deadbugz changed descriptor text after benign calls, so a mismatch can fail closed before the injected instructions reach the privileged model. This control applies to tool descriptors, not to prompts/get content.
Encode policy checks for each MCP tool's approved operation, side effects, privilege scope, and destructive behavior. Bind the exact descriptor and semantic profile to a signed approval, and require a new security review whenever either changes. This catches malicious initial contracts as well as Deadbugz's delayed change in tool meaning.
At the start of each request or session, intersect the authenticated user's stated task with the exact versioned tool registry, action budget, and grant lifetime, then enforce that signed scope at the dispatcher. A formatting or summarization task should never receive credential-reading, shell, email, or repository-write capabilities, so the poisoned instructions have no matching authority to invoke.
Expose only allowlisted, strongly typed, single-purpose tools with bounded paths, destinations, credentials, and side effects. Remove generic shell, broad filesystem, arbitrary HTTP, and equivalent ambient-power tools from the agent. Even if poisoned MCP text reaches the model, it no longer has a general mechanism for reading credential files, running arbitrary commands, or sending data anywhere.
Before executing code, sending email, changing a repository, or reading a protected credential path, independently validate the exact immutable action, target, parameters, current identity, and signed policy. When policy requires approval, bind it to that same action and consume it once at the executor. Attacker-authored MCP text cannot serve as authorization for the requested effect.
Value-Level Capability Metadata & Data Flow Sink Enforcement
High
Attach provenance and sensitivity labels to values read from credential paths, shell history, or Kubernetes configuration, then enforce sink policy at command, email, network, and repository dispatch. This blocks a sensitive value from leaving through a tool even if the model follows the injected instructions.
If investigation confirms that a Deadbugz configuration, script, package, or startup artifact was installed, remove the exact object from every authoritative configuration source and loaded runtime, preserve evidence, and verify that no runtime can load it again. This contains an installed artifact but does not replace review of actions already performed.
When evidence shows that a password, API key, SSH private key, client secret, or other long-lived credential was read or exposed, enumerate the exact affected objects and revoke, disable, or rotate them at every authoritative issuer and verifier. This is incident-scoped containment after exposure, not a reason to rotate all credentials based only on the presence of a malicious pull request.
What Defenders Should Do Now
Validate MCP configurations before commit or build acceptance. Disable unreviewed Deadbugz submissions, remove confirmed malicious configuration or code from every source and runtime, and preserve the relevant pull request, configuration, and execution evidence.
Pin canonical hashes for tools/list descriptors and separately pin approved prompts/get content. Reject any unapproved drift before model ingestion, and require a new security review for semantic changes.
Replace generic shell, broad filesystem, arbitrary HTTP, and unrestricted email or repository tools with narrow single-purpose capabilities. Grant only the tools and action budget required for the authenticated task.
Enforce exact-action validation at the executor for credential access, command execution, outbound email, and repository changes. Track the provenance of sensitive values and block transfers to unapproved network, email, command, and repository destinations.
Search endpoint, process, file-access, email, network, and repository telemetry for submitted server paths, later tool-list refreshes, credential-file reads, and read-then-send sequences. Rotate or disable only confirmed exposed long-lived credentials; separately revoke affected issued access tokens or sessions when evidence identifies them.
1 additional consideration
Consumer-side prompt-content integrity
Deadbugz also changed content returned by prompts/get. Tool-descriptor hashing and tool-contract admission directly protect tools/list, but prompt content needs its own consumer-side canonicalization and change-review boundary.
Recommendation: Pin approved prompt templates and digests, reject unapproved prompts/get drift before model ingestion, and require a fresh security review for every prompt-semantic change.
Conclusion
Deadbugz did not need an MCP protocol exploit. It attempted to turn a repository integration request and mutable MCP content into a delayed instruction channel. AIDEFEND ↗ maps the strongest defenses to the boundaries the campaign depends on: reject unsafe configuration before repository acceptance, pin and reapprove exact tool contracts, remove unnecessary tool authority, independently validate high-impact actions, and block sensitive values at dispatch. If installation or credential exposure is confirmed, remove the exact malicious artifacts and evict only the affected credentials. Endpoint identity or version pinning alone is insufficient when the same server can preserve its identity while changing what it tells an agent to do.