Deadbugz MCP supply chain campaign hit 23 AI projects in 74 minutes

The campaign

An attack campaign tracked as Deadbugz compromised 23 AI projects within 74 minutes, according to an analysis published on dev.to that draws on Freebuf reporting. The victims' own code was not the entry point. The intrusion moved through the MCP server supply chain — the protocol servers that AI agents rely on for tools and access to external systems.

The timescale is the detail the analysis emphasises. Compromising dependencies at that rate implies groundwork laid in advance and a target list assembled before execution began, rather than opportunistic scanning.

Advisories from the same window

Two advisories published in the same period describe weaknesses in the same layer, though neither matches the Deadbugz mechanism. CVE-2026-67357 covers a cluster-token leak in the ArcadeDB MCP server that would let an attacker impersonate root. CVE-2026-19956 is a server-side request forgery flaw in facebook-ads-mcp. Both, the dev.to piece argues, illustrate the kind of weakness supply-chain attackers look for first.

Separately, Snyk and Koi documented postmark-mcp as the first malicious MCP server found in the wild: a package that performs its advertised function while also carrying out undisclosed behaviour.

A large, thinly reviewed population

Independent counts cited in the article put the public MCP server population above 21,000, with an OX Security study built on a sample of 15,465 servers. Adversa AI counted 68 reportable MCP vulnerabilities in September 2026 alone. The analysis frames the 74-minute campaign as a matter of arithmetic: an ecosystem growing that quickly receives less scrutiny per package than the ecosystem it serves, which lets attackers prepare many candidate packages and exploit a chosen one quickly.

Cisco's open-source scanners

Cisco AI Defense released three scanning tools as open source: MCP Scanner, which inspects MCP server implementations; A2A Scanner, which targets agent-to-agent interfaces; and Skill Scanner, which examines skill definitions. Their value is that a package can be inspected before it is installed and executed. That value is bounded by what the scanners know to look for, which is why the analysis positions them as a supplement to procedural controls rather than a replacement.

Controls for the layer

Six controls recur in the guidance around these reports:

• Route MCP traffic through audit middleware, so a server's tool calls are recorded and can be reviewed afterwards.
• Set thresholds on file reads and flag anomalies, since the escalation paths in several advisories ran through file reads that no legitimate operation required.
• Require human confirmation for high-risk operations — writes, deletions and anything that opens network connections.
• Scan tool descriptions for injected instructions, because a description reaches the model as plain text.
• Pin tool versions by hash, turning an unexpected change into a detected one.
• Apply an approval workflow before a new MCP server reaches an environment.

Least privilege underpins all six. An MCP server running as a user with access only to the directories it needs confines the damage of a compromise to those directories, and it remains effective when a scanner misses something.

Why it matters

The episode shows that MCP servers have become a practical attack surface, not a theoretical one, and the speed of the Deadbugz campaign points to preparation rather than improvisation. Developers wiring agent tooling into their projects are pulling dependencies from a population of more than 21,000 servers that receives less review per package than established registries. The practical response is to treat an MCP server like any other third-party dependency: a known owner, a pinned version, a documented reason for inclusion, and a re-review whenever the version changes. As the dev.to analysis notes, that list does not need to cover all 21,000 servers — only the handful actually installed.