Unpinned MCP server launches can expose API keys, Corelight finds
Original title: Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials
Of 35 servers reviewed, 23 recommended installs pulled fresh registry dependencies; pinning the main package did not lock the rest.
Corelight found AI assistants launching Model Context Protocol servers that hold installer credentials through tools that rebuild dependencies from public registries. Pinning a release, version, or Git commit did not pin packages underneath, and one server produced 15 dependency sets across 19 rebuilds in five weeks. Corelight said this comes from setup choices, not a flaw in MCP, and advised hash-pinned lock files and least-privilege accounts.
Unconfirmed: Corelight describes a realistic supply-chain path; the article does not confirm a hijacked MCP dependency was used in attacks.
- One community server had 69 packages, and 23 changed versions without a configuration edit.
- Corelight froze five servers and started them 457 times over two weeks with no drift.
- A June 2026 Shai-Hulud variant on PyPI sought cloud credentials, GitHub tokens, and AI-tool keys.
- The article cites an mcp-remote flaw rated 9.6 but does not name a CVE.
Impact: API tokens, user files, and reachable network paths
| Product | Affected |
|---|---|
| MCP servers started with uvx or npx | — |
- 1.Pin installs to a commit and hash-locked file, and launch the server directly.
- 2.Disable start-up update checks and give each server a least-privilege account.
- 3.Hunt DNS and TLS contacts to PyPI, npm, and GitHub from assistant hosts.
- Products
- Model Context Protocoluvx
- Malware
- Shai-Hulud
- Organizations
- Corelight
From the original article
4 min read at cybersecuritynews.com
Security teams that run AI coding assistants may be exposing their most powerful credentials without knowing it. A new study shows that Model Context Protocol (MCP) servers can quietly change their own code after they are set up. If an attacker poisons just one package in that chain, they could steal API keys and administrator […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.