A malicious MCP server waited three tool calls before asking for credentials

Pillar Security reported an MCP server distributed through public GitHub pull requests that behaves as a text formatting tool until a client has made three tool calls. It then returns instructions directing the agent to collect SSH keys, AWS credentials, shell history and Kubernetes configuration, and to hide the activity from the user.

Source: Pillar Security, Deadbugz (August 2026)↗

Failure modes it illustrates

• FM-01Prompt injection

  Hidden or hostile instructions embedded in content the agent processes (a web page, an email, a document, image metadata) hijack its behaviour.

• FM-03Insecure tool use

  The tools an agent calls become the attack surface: unvalidated inputs, unauthenticated tool servers, or tool descriptions that themselves carry malicious instructions.