Loading story…
A wave of newly published Model Context Protocol (MCP) packages on PyPI expanded AI-agent access to browsers, Slack, Elasticsearch, MATLAB, UniFi Access, Lean, and Blender, while several projects openly documented significant security risks. Packages such as selenium-mcp, browsegrab, workos-slack-mcp-server, matlab-mcp-python, unifi-access-mcp, and lean-lsp-mcp advertised structured tool access for browser control, workspace messaging, code execution, infrastructure management, and theorem-prover interaction. Some maintainers included safeguards such as read-only modes, confirmation prompts, blocked-function lists, filename sanitization, and bearer-token authentication, but multiple listings also warned that MCP servers can expose local filesystems, execute privileged actions, or run arbitrary code if deployed without isolation.
Trace attribution and downstream blast radius.
13 events from the most recent confirmed update back to the earliest known activity.
The UniFi Access MCP Server version 0.1.4 was published on PyPI, exposing UniFi Access management functions to LLMs and automation platforms. The package described safe-by-default permissions and preview-before-confirm safeguards for mutating actions.
PyPI documentation for elasticsearch-client-mcp-py included an example configuration for an Alibaba Cloud Elasticsearch endpoint with a plaintext username and password. This appeared in package references for versions 0.5.1 and 0.6.0, creating a public credential exposure concern.
The elasticsearch-client-mcp-py package was published on PyPI as version 0.5.0, providing an Elasticsearch MCP server with read-only mode, search-size limits, and confirmation for write operations. The package metadata indicated it was uploaded using uv and not via Trusted Publishing.
A package named elasticsearch-client-mcp-py version 0.3.0 was published on PyPI. The reference provides no additional synopsis or incident details beyond the publication.
BlenderMCP version 1.5.5 was published on PyPI, connecting Blender to Claude AI through MCP for 3D scene manipulation. The documentation explicitly warned that its execute_blender_code capability can run arbitrary Python code inside Blender and is potentially dangerous.
MATLAB MCP Server version 1.3.0 was published on PyPI, enabling AI agents to execute MATLAB code through MCP. The package documentation highlighted security controls including blocked-function lists, filename sanitization, and session isolation.
A package named elasticsearch-client-mcp-py version 0.1.2 was published on PyPI. The reference provides no synopsis beyond the package publication.
browsegrab version 0.1.0 was published on PyPI as a lightweight browser automation library for local LLMs with an MCP-native server. The package emphasized token-efficient browser interaction using Playwright, accessibility-tree snapshots, and markdown conversion.
The workos-slack-mcp-server package was published on PyPI as version 1.0.0, providing a production-ready Slack MCP server for AI agents. The reference describes supported Slack operations and integration setup, but no security incident or breach.
The New Stack published a report describing Google's early WebMCP implementation in Chrome and the author's testing with a mock flight-search demo, WebMCP inspector, and Gemini API key. The article said the feature was experimental, required a Chrome preview build and feature flag, and was not enabled on ordinary websites by default.
Selenium MCP version 1.3.0 was published on PyPI, exposing Selenium WebDriver browser automation capabilities to AI agents through MCP tools. The package documentation included operational guidance and a recommended system prompt for safer automation.
The lean-lsp-mcp package was published on PyPI as version 0.25.1, offering an MCP server for agentic interaction with the Lean theorem prover. Its documentation warned that MCP introduces security concerns such as local filesystem access and lack of input/output validation.
A package named td-mcp version 0.1.1 was published on PyPI. The reference provides no additional synopsis or incident details beyond the publication.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
14 references tracked. Mallory keeps watching after this page renders.
pypi.org
Open sourcepypi.org
Open sourcepypi.org
Open sourcepypi.org
Open sourcethenewstack.io
Open sourcepypi.org
Open sourcepypi.org
Open sourcepypi.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Security researchers evaluated the risks associated with deploying Model Context Protocol (MCP) servers, which enable AI systems like ChatGPT to interact with external tools and data. One investigation used the GitHub MCP server in conjunction with OpenAI's Codex to analyze code, identify security issues, and propose fixes, highlighting how AI agents can streamline code review and vulnerability management. The study also explored whether AI-driven code analysis could be manipulated to conceal security flaws, emphasizing the importance of context and transparency in automated security workflows. Separately, honeypots simulating MCP server deployments were exposed to the internet to assess real-world attack activity. These honeypots, configured with varying authentication levels, were quickly discovered by internet scanners but did not experience targeted exploitation or MCP-specific attacks. The only notable incident was a controlled proof-of-concept prompt-hijacking flaw in a custom MCP build, which was not observed in the wild. The findings suggest that, while MCP servers are rapidly indexed by threat actors, current risks stem primarily from implementation errors rather than active targeting, underscoring the need for secure deployment practices and ongoing monitoring as MCP adoption grows.
Jun 29, 2026
Security researchers warned that the *Model Context Protocol (MCP)*—used to let AI assistants connect to local tools and enterprise SaaS data—creates a significant attack surface when organizations install or authorize MCP “servers” and tool integrations. Praetorian highlighted that **locally hosted MCP servers run with the user’s privileges** and can therefore execute arbitrary commands, access local files, install malware, and exfiltrate data while masquerading as legitimate productivity tooling; it also described **“MCP server chaining,”** where a malicious local MCP server abuses data and actions flowing through a trusted remote integration (e.g., Slack/Google Drive) without needing to compromise the official provider. Separately, Gopher Security emphasized a **trust and auditability gap** in MCP deployments: standard logging for remote tool execution can be incomplete or tampered with, and organizations often cannot prove what code ran or what parameters were used inside a remote “black box” execution environment. The post described “puppet”/interception-style scenarios where an attacker could alter an MCP request (e.g., changing tool-call parameters to trigger data exfiltration or unauthorized actions) while returning plausible “success” responses, and proposed cryptographic approaches (e.g., **zero-knowledge proofs**) to make MCP tool execution verifiable rather than relying on mutable logs.
Jun 29, 2026