Analysis
Detecting Misbehaving AI Agents
Publication date unknown · Discovered abnormal.ai
Page published
Publication date unknown · First observed: 31 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Post-approval changes to MCP tool metadata can redirect agents toward credential theft, making initial approval insufficient without ongoing attribution and behavioral monitoring.
Abnormal AI argues that agent monitoring requires identity attribution, behavioral baselines expressed as ranges, and records of owner-approved changes. The article illustrates post-approval risks with the reported Deadbugz campaign, whose MCP server changed tool metadata after three benign calls to steer agents toward credentials and conceal the activity; none of the campaign's pull requests had been merged at review time, and no compromise was confirmed.