This year’s MCP attacks, and how Plango stops them
Apex fake accelerator
Details
In October, Elastic published a campaign aimed at crypto founders. A fake Web3 accelerator called Apex offered free AI credits through npm packages under @apexacc, including an MCP server called @apexacc/audit. When your agent starts @apexacc/audit, the server installs a stealer for browser passwords, wallets and messenger data.
How we stop it
Plango checks the package behind every MCP server against OSV’s malware list, using the version you pinned or the one already sitting in your npx or uv cache. Once OSV lists @apexacc/audit, Plango marks the server Critical in AI Agents. Servers Plango guards can run in a sandbox to keep them from opening browser data, the Keychain, or your SSH and cloud keys.
Deadbugz delayed rug pull
Details
In August, one GitHub account sent pull requests to 23 projects, each adding a server called productivity-suite-mcp with two dull tools, format_text and summarize, that behaved for three calls and then rewrote their descriptions to tell the agent to collect SSH keys, AWS credentials, kube config and shell history, and to keep quiet about it.
How we stop it
Plango keeps a fingerprint of every tool list a server hands the AI and marks a trusted server Changed when its list changes. Orders to hunt for keys push the server to Critical, and when the agent reaches for ~/.ssh or ~/.aws, Plango asks you first.
Tool description poisoning
Details
In June, Microsoft showed a calculator tool with a second job: you see “add two numbers”, while the AI also reads an instruction to open your SSH key and pass it along as an argument.
How we stop it
Plango reads every tool name, description and argument description the AI sees, looking for orders to read secrets, invisible characters and requests to hide things from you. Plango flags a poisoned tool, asks you before the agent opens the key, and treats a private key inside a tool’s arguments as Critical.
SANDWORM_MODE
Details
In February, Socket found 19 npm packages posing as libraries like supports-color that quietly wrote a rogue MCP server into the configs of Claude Code, Claude Desktop, Cursor, Windsurf and Continue. The rogue server’s tools had harmless names like lint_check and scan_dependencies, but their descriptions told the agent to read ~/.ssh, ~/.aws, npm tokens and .env files.
How we stop it
Plango reads the MCP configs of 13 coding tools, those five included, marks any server it hasn’t seen before as New, and asks you before the agent does the key reads those tools want.
Shai-Hulud in the MCP Registry
Details
The Shai-Hulud worm made it into the official MCP Registry in August with a clean package and a trapped GitHub repo. Opening the repo ran setup.mjs through a startup hook in .claude/settings.json and a VS Code folder-open task, and setup.mjs went after GitHub, npm and cloud tokens.
How we stop it
Plango scans the repos you work in for anything that runs on open, including Claude startup hooks, VS Code folder-open tasks, settings that switch on every project MCP server, and overrides that send an agent’s API traffic somewhere else. Plango rates a startup hook High, or Critical when its script downloads code or reaches for credentials, and marks the hook Changed if someone edits the script later.
Cursor DeepJack
Details
In July, Adversa showed that a cursor:// link could install an attacker’s MCP server with one click and one confirmation.
How we stop it
The server still has to land in ~/.cursor/mcp.json, where Plango finds it and marks it New in AI Agents.
Windsurf config rewrite and the STDIO family
Details
In April, OX Security pointed out that MCP clients run whatever command a config hands them. In Windsurf (CVE-2026-30615), a crafted page could rewrite the local MCP config without a single click.
How we stop it
Plango flags any new server, and raises its risk when its command pipes a download into a shell or runs an inline sh -c script.
mcp-atlassian and mcp-gitlab uploads
Details
In September, mcp-atlassian shipped about 25 security fixes at once, several for an upload_attachment tool that would read any local file and post it to Jira or Confluence. The upload_markdown tool in @zereight/mcp-gitlab (CVE-2026-61560) would read any local file and post it to GitLab.
How we stop it
Plango reads the file paths in every tool call and stops reads of SSH keys, cloud credentials and other secrets, and a server Plango guards can run in a sandbox that refuses those files even when the server goes for them on its own.
gemini-mcp-tool command injection
Details
In June, a crafted prompt could get gemini-mcp-tool (CVE-2026-0755) to run a shell command inside the server.
How we stop it
A server Plango guards can run in a sandbox, where that shell can run but can’t open your keys, credentials or browser data.
mcp-remote
Details
In 2025, JFrog found that mcp-remote (CVE-2025-6514) would run a command hidden in a malicious server’s sign-in address.
How we stop it
When Plango guards mcp-remote, mcp-remote can run in a sandbox that keeps that command away from your keys, credentials and browser data.
Plugin4Shell
Details
In September, AIR Security showed that pinning an agent plugin to a commit hash didn’t pin much, because pushing a branch named exactly like the hash updates the plugin to whatever the branch holds.
How we stop it
Plango fingerprints every plugin file and marks a swapped plugin Changed.
DNS rebinding and MCP Inspector
Details
Between May and September, at least seven local MCP servers turned out to trust any web page that asked, so a site you visit could reach them through DNS rebinding and call their tools. In 2025, MCP Inspector (CVE-2025-49596) accepted connections with no password on every network interface.
How we stop it
When an agent runs a server on 0.0.0.0, Plango flags it as Open to network, along with any other open ports on your Mac.
GitHub MCP toxic flow
Details
In 2025, researchers showed an issue in a public repo that told the agent to copy data from your private repos into a public pull request.
How we stop it
Plango tracks untrusted input within a session, so when the agent reads something from a tool or a web page and then sends data out, it raises the risk of that call.