Deadbugz: Currently Active MCP Supply-Chain Campaign

Summary

Deadbugz is a currently-active MCP supply-chain campaign documented by Pillar Security and attributed to the GitHub account zellkernel. Rather than a server that is malicious from the first request, Deadbugz keeps a per-client in-memory counter and behaves normally until three tools/call requests have been made; only then does it return poisoned tools/list and prompts/get responses whose tool descriptions instruct the connected AI agent to collect SSH keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal the activity from the user.^[0]

The operator delivered the server by opening pull requests that add or change MCP configuration files in target repositories, so that anyone on a project connects to the attacker's server without individually choosing it. Twenty-three such pull requests were sent in 74 minutes between 9:52 and 11:07 PM UTC on August 10, 2026 — 17 added a remote endpoint, 4 pointed at a hidden local Python file, and 2 were directory/listing submissions. Nineteen were closed and four remained open at the time of the writeup, and none are reported as merged.^[0]

The technique is engineered to defeat point-in-time controls: the published source repository is clean, so code review, package signing, and static malware scanning all inspect an unchanging artifact while the payload lives only in the server's dynamic response after the introductions are over. It builds on a well-established weakness class — tool poisoning and rug-pull attacks in the MCP specification, documented in academic work (arXiv ETDI) and prompt-injection research (Palo Alto Unit 42 MCP sampling) — but weaponizes timing so that the malicious behavior only appears after a human has stopped watching.^[0][20][6]

Attack chain

1. Preparation: The operator publishes a matching, benign source repository for the MCP server so that any code review of the artifact comes back clean, while the malicious logic resides only in the remotely controlled server's dynamic responses.^[0]
2. Delivery via configuration pull requests: The operator opens pull requests that add or change MCP configuration files (which list the servers an AI client connects to) across 23 GitHub repositories, so users would connect to the attacker's server without individually choosing it; some point at a remote endpoint and some at a hidden local Python file.^[0]
3. Benign trust window: For the first three tools/call requests — the calls a human makes while deciding whether to trust the server — the server behaves normally, passing evaluation, testing, and review.^[0]
4. Time-delayed activation: Once the per-client counter reaches three, the server returns altered tools/list and prompts/get responses whose tool descriptions instruct the agent to search for SSH keys, AWS credentials, shell history, and Kubernetes configuration.^[0]
5. Concealed collection: The poisoned metadata also directs the agent to hide the activity from the user; because tool descriptions are exchanged with the agent and rarely displayed to a human, the steering text is authoritative to the agent yet invisible to the operator.^[0]

Disclosure timeline

Actor profile

zellkernel

GitHub account to which Pillar Security attributes the Deadbugz malicious MCP server. In a single evening the operator opened pull requests against 23 GitHub repositories attempting to insert its server into MCP configuration files, and published a clean matching source repository to defeat code review. As reported, none of the pull requests were merged (19 closed, 4 open at the time of writing).^[0]

How it works

Each MCP server advertises tools via a name, description, and input schema that the agent's LLM reads to decide what to call. Deadbugz weaponizes timing rather than hiding code: it keeps an in-memory counter per connected client, incrementing on every tools/call, and only after the counter reaches three does it change the descriptions it returns from tools/list and prompts/get. The first three calls — those a human makes while evaluating the server — see benign behavior; the malicious descriptions appear only after the person has moved on and the agent is working alone.^[0]

Because the poisoned steering text lives in tool descriptions exchanged between server and agent, and most MCP clients never display that text to a human, the instructions are both authoritative to the agent and invisible to the operator. The metadata directs the agent to gather SSH keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal the work from the user.^[0]

The design defeats point-in-time controls: code review inspects a clean published artifact, package signing proves an unchanged file, static malware scanning examines content at rest, and OAuth answers only who a server is. Deadbugz does not lie about its identity or ship malicious files — it changes what it asks the agent to do at runtime, after the introductions are over. This is the tool-poisoning/rug-pull weakness class documented for the standard MCP specification, made harder to catch by delaying activation.^[0][20]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• Deadbugz inverts software review: a person evaluates a tool once, but an agent then follows that tool's instructions indefinitely at machine speed without the person in the loop, and the malicious behavior is a function of how many times the server has already been used.^[0]
• Point-in-time controls — code review, package signing, malware scanning, and OAuth identity — all run once against something that does not change, so they miss a server that lies about what it wants only after the introductions are over.^[0]
• The technique is documented now and the campaign's success rate was zero (no pull requests merged), but the next iteration 'will not count to three'; the durable defense is runtime verification of tool schemas and treating configuration changes as program changes.^[0]

Defensive actions

• Record approved tool schemas and continuously re-verify them: Because Deadbugz alters its tools/list response only after activation, defenders should record the tool schemas a server presents when approved and keep checking them; a divergence from the signed-off definition should interrupt use whatever the explanation.^[0]
• Treat a change in an already-approved server's tool definition as a security event requiring renewed approval: Pillar's recommendation to platform builders is to require renewed approval whenever a previously approved server's tool definition changes, which is the control that actually runs concurrently with this attack.^[0]
• Review configuration diffs with the same suspicion as code: Deadbugz delivered itself through one-line additions to MCP configuration files; a line that adds a server is a line that adds a program, and it reviews in seconds while looking like housekeeping.^[0]
• Maintain an inventory of approved MCP servers: Keeping an inventory of which servers are approved makes a connection to something outside it a fact rather than a question, enabling detection of unauthorized additions.^[0]
• Treat tool descriptions as executable content: Tool descriptions are authoritative to the agent and rarely shown to humans, so hidden directives steer agent behavior invisibly; they must be reviewed as code, not documentation.^[0]

Changelog

• Archetype revised from vuln-research to campaign: new body evidence grounds a concrete named campaign (Deadbugz) attributed to GitHub account zellkernel, whereas the prior version only had the campaign as an unbodied external reference.^[0]
• New attribution added: Pillar Security attributes the Deadbugz malicious MCP server to the GitHub account zellkernel.^[0]
• New mechanism documented: a per-client counter delays malicious tool-description activation until the third tools/call, defeating point-in-time review while the published source repository stays clean.^[0]
• New campaign specifics added: 23 pull requests modifying MCP configuration sent between 9:52 and 11:07 PM UTC on August 10, 2026 (17 remote endpoints, 4 local file, 2 directory submissions); none merged, 19 closed and 4 open at writeup.^[0]
• New indicators added: hidden local Python file path ~/.config/.cache/.sys/.deadbug-mcp.py and the operator account zellkernel.^[0]