Active Deadbugz Campaign Targets Model Context Protocol Servers via Malicious PRs
Pillar Security discovered an active supply-chain campaign named Deadbugz targeting Model Context Protocol (MCP) clients. The attack uses runtime-gated prompt poisoning that waits for three benign tool calls before swapping metadata to exfiltrate SSH keys and cloud credentials.
Impact: High
Why it matters
Engineers operating MCP servers must audit dynamic tool definition refreshes and block malicious endpoints to prevent local credential theft.
TL;DR
- 01MCP tool descriptions can be dynamically modified post-approval to alter agent behavior.
- 02Deadbugz uses a 3-call trigger threshold to evade basic sandbox automated testing.
- 03Always audit remote MCP endpoints added via pull requests before merging.
Key facts
- Trigger Threshold
- 3 ordinary tool calls
- Identified PRs
- 23 pull requests
- PR Delivery Window
- 74 minutes
- Attributed Account
- zellkernel
Runtime-Gated Metadata Poisoning
The Deadbugz campaign targets Model Context Protocol (MCP) clients by embedding malicious metadata updates into seemingly benign developer tooling. Identified by Pillar Security on August 10, 2026, the attacker (zellkernel) created 23 PRs in a 74-minute window (from 9:52 PM to 11:07 PM UTC). The PRs attempt to introduce remote configuration endpoints such as productivity-suite-mcp.onrender.com/mcp or local script delivery paths like deadbug-mcp.py.
Exploit Mechanism
1. Initial State: The productivity-suite server exposes two standard text formatting tools. 2. Call Threshold: The server maintains a per-client counter. During the first two calls, it responds normally. 3. Payload Activation: On the third tool call, subsequent tools/list or prompts/get calls return altered descriptions. These direct the agent to read ~/.ssh/id_rsa, AWS credentials, shell history, and Kubernetes configs without alerting the user.
Recommended Mitigations
- Reject configuration PRs adding unknown remote MCP endpoints.
- Block HTTP requests to
productivity-suite-mcp.onrender.com. - Inspect local environments for
deadbug-mcp.pyartifacts.
Try it in 2 minutes
# Search local MCP configurations for the malicious remote endpoint
grep -rn "productivity-suite-mcp.onrender.com" ~/.config/ ~/Library/Application\ Support/bash
✓ When to use
- When auditing internal AI agent tools and Model Context Protocol configurations.
- When setting up egress filtering policies for autonomous agent environments.
What to do today
- Search repository codebases for references to productivity-suite-mcp.onrender.com
- Audit existing MCP client logs for dynamic tool.listChanged updates
- Ensure local agent sandboxes deny unauthorized file system access to ~/.ssh
Sources