Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials

Security teams that run AI coding assistants may be exposing their most powerful credentials without knowing it. A new study shows that Model Context Protocol (MCP) servers can quietly change their own code after they are set up.

If an attacker poisons just one package in that chain, they could steal API keys and administrator logins. MCP servers let AI assistants talk to other tools, such as firewalls, SIEM platforms and cloud consoles.

To do this work, they usually hold the keys of the person who installed them. Attackers already know this. A malicious MCP server found in the wild has shown how easily one trusted tool can leak data.

Researchers at Corelight noted the weakness while checking an administrator’s workstation. They did not find malware there.

They found AI assistants running MCP servers with privileged access, and they asked where the code in those servers came from and how it got updated. The answer is in Corelight’s research, published on November 10, 2026.

Hackers Could Exploit MCP Server Supply Chain Weaknesses

The assistants launched their MCP servers with a one-step tool called uvx. It downloads a Python package and runs it from a single line of settings. The settings looked safe, because they named an exact release, a version number or a Git commit.

The catch is that pinning the main package does not pin the packages underneath it. One community server had pinned its seven direct dependencies and even published a hash-locked file.

But the launcher ignored that file and fetched the roughly 60 other packages fresh from the Python Package Index (PyPI) whenever it rebuilt its environment.

Over five weeks, that one server was rebuilt 19 times and produced 15 different sets of dependencies. Of its 69 packages, 23 changed versions, including the cryptography library and the MCP software kit itself.

Nobody had touched the configuration. Corelight saw the same drift on every server launched this way. Every one of those packages runs inside the same process as the server.

That means any of them can read the API tokens, the user’s files and the network paths the server can reach. A bad update does not even need to be called.

Some malicious packages run the moment Python starts. The risk is not limited to Python. Some vendors tell users to start a local proxy with npx and a “latest” tag.

That fetches the newest version at every start. It also echoes the critical mcp-remote flaw rated 9.6 on the CVSS scale, where fast updates helped, but a hijacked release would spread just as fast.

Corelight stressed that this is not a flaw in MCP itself. Each case came from a setup choice. Of the 35 MCP servers it reviewed, 23 had a recommended install that would pull dependencies fresh from a public registry.

Why Package Hijacks Make This Worse

Attackers go after whichever dependency is easiest to take over. That might be a maintainer account with a reused password, a phished token or a weak release pipeline.

The bad version then looks like a normal update. Corelight pointed to past cases such as xz Utils, Ultralytics and Nx, where stolen tokens and keys were the prize.

The Shai-Hulud npm worm is a recent example. It used stolen npm tokens to publish infected versions of every package a victim maintained.

A June 2026 variant reached PyPI and went after cloud credentials, GitHub tokens and API keys for AI coding tools. In one wave, six bad releases were live for under 30 minutes.

A server that rebuilds every couple of days, and starts on its own, has more chances to land in a window like that. This pattern matches wider reports of how attackers poison trusted software updates to reach developer and cloud secrets.

A managed update has a build you control and a version number you can see. A launcher that rebuilds at start-up offers neither, and the server’s own version number never changes.

Corelight showed how to spot the problem. DNS and TLS logs list the hosts that contact GitHub, PyPI and npm. In its lab, that left four hosts.

Endpoint data then showed that only the administrator’s workstation installed PyPI packages, and it did so whenever an AI assistant started its servers. Those servers made more than 1,600 connections in a week to 11 management systems.

The fix is to freeze the environment. Teams should pin to a commit, install from a hash-pinned lock file, launch the server directly and turn off start-up update checks.

Corelight froze five servers and started them 457 times over two weeks, and their package lists never changed. Each server should also get its own account with the least access it needs, and a named owner should review updates on a schedule.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials appeared first on Cyber Security News.