"Deadbugz": A Malicious MCP Server Stays Benign for Exactly Three Tool Calls, Then Starts Hunting SSH Keys

AI and developer-tool projects on GitHub that accepted or reviewed configuration pull requests adding an MCP server

Pillar Security documented an active campaign distributing a malicious MCP server called `productivity-suite` through public GitHub pull requests. A single account, `zellkernel`, whose GitHub profile links to the X account `@llmgod` and back again, filed 23 pull requests against unrelated projects inside a 74-minute window from 21:52 to 23:07 UTC on August 10, 2026; 17 configured a remote MCP endpoint at `productivity-suite-mcp.onrender.com/mcp`, 4 referenced a hidden local Python script dropped at `~/.config/.cache/.sys/deadbug-mcp.py`, and 2 were directory submissions. Nineteen were closed and four were still open at review. The server offers two harmless tools, text formatting and summarization, and holds a per-client counter: after exactly three tool calls it changes the tool definitions and prompt responses it returns over the MCP protocol, and the new metadata instructs the connected agent to look for SSH keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal the activity from the user. Adversa AI's September 2026 MCP roundup carried the campaign forward alongside three further MCP server CVEs disclosed in August covering a path traversal giving any authenticated client arbitrary file reads, a settings tool returning a cluster token in cleartext, and a plain SSRF

MCP tool definitions and prompt responses are instructions the agent trusts, and the server controls them at runtime rather than at install time. A reviewer inspecting a new server sees only what it chooses to show on the first three calls, so code review and registry vetting are defeated by construction: the payload does not exist in any artifact until after the server has been trusted and put to work