Skip to content
NewA calmer, faster ZeroHour
StoryResearchmedium

Corelight Finds MCP Servers Silently Reload Unpinned PyPI Dependencies

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Corelight says AI assistants rebuild MCP servers from drifting PyPI packages, loading unreviewed code with enterprise credentials.

Corelight's lab found that AI coding assistants start Model Context Protocol servers with uvx, which resolves Python dependencies from PyPI on every rebuild even when a release or Git commit is pinned. On one workstation, every server started that way drifted; one pinned release produced 15 dependency environments across 19 rebuilds in five weeks, and 23 of 69 packages on one community server changed without a configuration edit. Of 35 servers reviewed, 23 recommended installs that pull from a public registry. Loaded code inherits the server's tokens, files, and network access, and assistants can start servers automatically. Corelight says this is a setup choice, not an MCP flaw, and recommends hash-pinned lock files and least-privilege accounts.

Key facts
  • Nineteen rebuilds of one pinned release produced 15 environments in five weeks.
  • Twenty-three of 69 packages on one server changed without a configuration edit.
  • Of 35 MCP servers reviewed, 23 recommended public-registry installs.
  • Five frozen servers started 457 times over two weeks showed no drift.
  • The lab host made over 1,600 connections in a week to 11 systems.
  • Forty packages in one frozen server were already older than the registry.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersWorkstation connection volume and packages already older than the registry that day.
  • Cyber Security NewsAdvises least-privilege accounts with hash-pinned lock files.
Products
Model Context Protocoluvxmcp-remote
Malware
Shai-Hulud
Organizations
Corelight

Coverage

oldest first · one row per article · UTC
  1. · 11h ago GBHackersFirst report

    Corelight: MCP servers can pull unreviewed packages with admin access

    On one lab workstation, 19 rebuilds of one pinned MCP release produced 15 environments as transitive PyPI packages drifted.

  2. · 4h ago Cyber Security News

    Unpinned MCP server launches can expose API keys, Corelight finds

    Of 35 servers reviewed, 23 recommended installs pulled fresh registry dependencies; pinning the main package did not lock the rest.