GenAI-Security-Project · gautamgb · Sep 18, 2026
@@ -82,7 +82,7 @@ Every file answers one question: **which controls from framework X address vulne
 | **70+** open-source tools | Catalogued and organised by function |
 | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries |
 | **<!-- stats:frameworks-mapped -->26<!-- /stats -->** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) |
-| **<!-- stats:incidents -->134<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
+| **<!-- stats:incidents -->135<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
 | **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk |
 
 All free. All open-source. Built for practitioners.

@@ -1326,6 +1326,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2025,
       "incident_id": "INC-111"
+    },
+    {
+      "name": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-136"
     }
   ],
   "crossrefs": {

@@ -742,7 +742,14 @@
       "tier": "Foundational",
       "scope": "Both",
       "confidence": "unreviewed",
-      "reviewed_by": []
+      "reviewed_by": [],
+      "evidence_count": 0,
+      "evidence": {
+        "confirmed": [],
+        "drafted": [
+          "INC-136"
+        ]
+      }
     },
     {
       "framework": "MAESTRO",
@@ -1261,6 +1268,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2026,
       "incident_id": "INC-132"
+    },
+    {
+      "name": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-136"
     }
   ],
   "crossrefs": {

@@ -1173,6 +1173,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2025,
       "incident_id": "INC-114"
+    },
+    {
+      "name": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-136"
     }
   ],
   "crossrefs": {

@@ -8416,6 +8416,80 @@
           "confirmed_by": []
         }
       ]
+    },
+    {
+      "id": "INC-136",
+      "title": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+      "date": "2026-08",
+      "year": 2026,
+      "category": "research-demonstrated",
+      "severity": "High",
+      "description": "Pillar Security disclosed an active MCP supply-chain campaign it named Deadbugz. A remotely-hosted MCP server published as \"productivity-suite\" advertised two ordinary tools, format_text and summarize, and behaved as documented. The server kept an in-memory, per-client counter; once a client session reached three tool calls, its tools/list and prompts/get responses instead carried instructions directing the attached agent to locate SSH private keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal that activity from the operator. Delivery was attempted through 23 pull requests opened against unrelated AI, MCP, and developer-tool repositories between 21:52 and 23:07 UTC on 2026-08-10, each adding the server to the target project's MCP client configuration. None had been merged at the time of review (19 closed, 4 open), so this is a documented delivery attempt rather than a confirmed compromise. The distinguishing property is that the poisoning is gated on runtime behavior rather than carried in the published artifact: a reviewer who connects, lists tools, and disconnects observes only the benign contract, as does any verifier that re-checks on a fresh session, because a new session is always below the threshold. The server name, repository, and published version never change; only what is served does.",
+      "owasp_entries": [
+        "ASI04",
+        "ASI01",
+        "ASI02"
+      ],
+      "maestro_layers": [
+        {
+          "layer": "L3",
+          "label": "Agent Frameworks",
+          "role": "origin",
+          "notes": "Malicious MCP server presents a benign tool contract at registration and connect time"
+        },
+        {
+          "layer": "L6",
+          "label": "Security & Compliance",
+          "role": "propagation",
+          "notes": "Call-count gating defeats connect-and-check audits; a fresh session never reaches the threshold"
+        }
+      ],
+      "attack_vector": "Call-count-gated tool-response poisoning: a remotely-hosted MCP server serves its documented, benign contract for the first two tool calls in a session, then substitutes credential-harvesting instructions into tools/list and prompts/get responses starting on the third call, with the instructions also directing the agent to conceal the activity",
+      "affected": "23 pull requests, all authored by the same GitHub account (zellkernel), opened against unrelated AI, MCP, and developer-tool repositories over a 74-minute window on 2026-08-10 (21:52-23:07 UTC); 19 closed, 4 open, none merged at time of review",
+      "impact": "No confirmed compromise as of disclosure; a demonstrated delivery and audit-evasion technique that a single-session, connect-and-check verification cannot detect by construction",
+      "mitigations": [
+        "Re-audit MCP servers across multiple tool calls within a session rather than a single connect-and-check",
+        "Bind tool responses to a published contract and flag any runtime divergence from it",
+        "Persist per-server behavioral history across sessions instead of trusting each fresh connection independently"
+      ],
+      "external_refs": [
+        {
+          "source": "research",
+          "id": "Pillar Security — Deadbugz (2026-08)",
+          "url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign"
+        },
+        {
+          "source": "campaign",
+          "id": "Deadbugz"
+        }
+      ],
+      "references": [
+        {
+          "title": "Pillar Security — Deadbugz MCP supply-chain disclosure",
+          "url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign",
+          "type": "research"
+        }
+      ],
+      "tags": [
+        "mcp",
+        "supply-chain",
+        "tool-poisoning",
+        "asi01",
+        "asi02",
+        "asi04",
+        "pillar-security",
+        "draft-evidence"
+      ],
+      "control_failures": [
+        {
+          "framework": "MAESTRO",
+          "control_id": "L6",
+          "outcome": "present-but-misconfigured",
+          "basis": "Standard registry and client-side review (list tools, inspect one session, disconnect) is structurally blind to behavior gated on call count, since every review session starts below the threshold.",
+          "source_url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign",
+          "confirmed_by": []
+        }
+      ]
     }
   ]
 }
@@ -61,15 +61,15 @@
     }
   },
   "incidents": {
-    "total": 134
+    "total": 135
   },
   "evidence": {
-    "incidents_annotated": 16,
-    "control_failures": 21,
+    "incidents_annotated": 17,
+    "control_failures": 22,
     "confirmed": 0,
-    "drafted": 21,
+    "drafted": 22,
     "mappings_with_confirmed_evidence": 0,
-    "mappings_with_drafted_evidence_only": 21,
+    "mappings_with_drafted_evidence_only": 22,
     "orphan_failures": 1
   },
   "freshness": {

@@ -14163,6 +14163,12 @@ window.CROSSWALK_DATA = [
         "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
         "year": 2025,
         "incident_id": "INC-111"
+      },
+      {
+        "name": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+        "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+        "year": 2026,
+        "incident_id": "INC-136"
       }
     ],
     "crossrefs": {
@@ -14930,7 +14936,14 @@ window.CROSSWALK_DATA = [
         "tier": "Foundational",
         "scope": "Both",
         "confidence": "unreviewed",
-        "reviewed_by": []
+        "reviewed_by": [],
+        "evidence_count": 0,
+        "evidence": {
+          "confirmed": [],
+          "drafted": [
+            "INC-136"
+          ]
+        }
       },
       {
         "framework": "MAESTRO",
@@ -15449,6 +15462,12 @@ window.CROSSWALK_DATA = [
         "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
         "year": 2026,
         "incident_id": "INC-132"
+      },
+      {
+        "name": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+        "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+        "year": 2026,
+        "incident_id": "INC-136"
       }
     ],
     "crossrefs": {
@@ -17992,6 +18011,12 @@ window.CROSSWALK_DATA = [
         "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
         "year": 2025,
         "incident_id": "INC-114"
+      },
+      {
+        "name": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+        "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+        "year": 2026,
+        "incident_id": "INC-136"
       }
     ],
     "crossrefs": {

@@ -1,5 +1,5 @@
 // Auto-generated by scripts/generate.js — do not edit manually
-// Incidents: 134
+// Incidents: 135
 window.CROSSWALK_INCIDENTS = [
   {
     "id": "INC-001",
@@ -8414,5 +8414,79 @@ window.CROSSWALK_INCIDENTS = [
         "confirmed_by": []
       }
     ]
+  },
+  {
+    "id": "INC-136",
+    "title": "Deadbugz — MCP server serves poisoned tool metadata after three calls",
+    "date": "2026-08",
+    "year": 2026,
+    "category": "research-demonstrated",
+    "severity": "High",
+    "description": "Pillar Security disclosed an active MCP supply-chain campaign it named Deadbugz. A remotely-hosted MCP server published as \"productivity-suite\" advertised two ordinary tools, format_text and summarize, and behaved as documented. The server kept an in-memory, per-client counter; once a client session reached three tool calls, its tools/list and prompts/get responses instead carried instructions directing the attached agent to locate SSH private keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal that activity from the operator. Delivery was attempted through 23 pull requests opened against unrelated AI, MCP, and developer-tool repositories between 21:52 and 23:07 UTC on 2026-08-10, each adding the server to the target project's MCP client configuration. None had been merged at the time of review (19 closed, 4 open), so this is a documented delivery attempt rather than a confirmed compromise. The distinguishing property is that the poisoning is gated on runtime behavior rather than carried in the published artifact: a reviewer who connects, lists tools, and disconnects observes only the benign contract, as does any verifier that re-checks on a fresh session, because a new session is always below the threshold. The server name, repository, and published version never change; only what is served does.",
+    "owasp_entries": [
+      "ASI04",
+      "ASI01",
+      "ASI02"
+    ],
+    "maestro_layers": [
+      {
+        "layer": "L3",
+        "label": "Agent Frameworks",
+        "role": "origin",
+        "notes": "Malicious MCP server presents a benign tool contract at registration and connect time"
+      },
+      {
+        "layer": "L6",
+        "label": "Security & Compliance",
+        "role": "propagation",
+        "notes": "Call-count gating defeats connect-and-check audits; a fresh session never reaches the threshold"
+      }
+    ],
+    "attack_vector": "Call-count-gated tool-response poisoning: a remotely-hosted MCP server serves its documented, benign contract for the first two tool calls in a session, then substitutes credential-harvesting instructions into tools/list and prompts/get responses starting on the third call, with the instructions also directing the agent to conceal the activity",
+    "affected": "23 pull requests, all authored by the same GitHub account (zellkernel), opened against unrelated AI, MCP, and developer-tool repositories over a 74-minute window on 2026-08-10 (21:52-23:07 UTC); 19 closed, 4 open, none merged at time of review",
+    "impact": "No confirmed compromise as of disclosure; a demonstrated delivery and audit-evasion technique that a single-session, connect-and-check verification cannot detect by construction",
+    "mitigations": [
+      "Re-audit MCP servers across multiple tool calls within a session rather than a single connect-and-check",
+      "Bind tool responses to a published contract and flag any runtime divergence from it",
+      "Persist per-server behavioral history across sessions instead of trusting each fresh connection independently"
+    ],
+    "external_refs": [
+      {
+        "source": "research",
+        "id": "Pillar Security — Deadbugz (2026-08)",
+        "url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign"
+      },
+      {
+        "source": "campaign",
+        "id": "Deadbugz"
+      }
+    ],
+    "references": [
+      {
+        "title": "Pillar Security — Deadbugz MCP supply-chain disclosure",
+        "url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign",
+        "type": "research"
+      }
+    ],
+    "tags": [
+      "mcp",
+      "supply-chain",
+      "tool-poisoning",
+      "asi01",
+      "asi02",
+      "asi04",
+      "pillar-security",
+      "draft-evidence"
+    ],
+    "control_failures": [
+      {
+        "framework": "MAESTRO",
+        "control_id": "L6",
+        "outcome": "present-but-misconfigured",
+        "basis": "Standard registry and client-side review (list tools, inspect one session, disconnect) is structurally blind to behavior gated on call count, since every review session starts below the threshold.",
+        "source_url": "https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign",
+        "confirmed_by": []
+      }
+    ]
   }
 ];