Attackers shifted focus in 2026 from compromising foundation models to poisoning the plugins, MCP servers, and IDE extensions that agents trust at runtime. The llm plugin supply chain attack trend includes the active Deadbugz campaign, coordinated IDE marketplace compromises, and OWASP-documented tool description manipulation that steers agents toward credential theft without exploiting the LLM itself.
This explainer catalogs 2026 incident themes, models the plugin and connector risk surface, reviews signing and verification controls, and outlines enterprise allowlisting practices. Security teams should treat tool metadata as executable policy, not passive documentation, because agents follow tool-supplied instructions as operator guidance.
2026 Incident Themes
Three incident classes dominated AI supply-chain reporting in 2026: runtime-gated MCP metadata poisoning, malicious IDE and editor extensions, and repository pull-request campaigns that introduce trusted connectors. Each exploits the gap between one-time security review and continuous runtime behavior monitoring.
| Campaign or class | Technique | Disclosed by |
|---|---|---|
| Deadbugz | MCP server poisons tool metadata after three benign calls | Pillar Security, CSA (August-September 2026) |
| IDE plugin campaigns | Fake AI assistants exfiltrate API keys from editor settings | CSA developer toolchain note (June 2026) |
| GitHub PR supply chain | Unsolicited PRs add productivity-suite MCP configs | Pillar Security (23 PRs in 75 minutes, August 2026) |
| Tool description poisoning | Malicious instructions embedded in tool schemas | OWASP MCP Top 10 (MCP03:2025 class) |
Deadbugz distributed a server called productivity-suite through public GitHub pull requests. The server offered benign text formatting for the first three tool calls, then rewrote its own metadata to instruct connected agents to search for SSH keys, AWS credentials, Kubernetes configs, and shell history while concealing activity from the operator. Researchers noted the three-call threshold appears calibrated to survive cursory manual or automated review.
Deadbugz Indicators of Compromise
Security teams should watch for the productivity-suite-mcp.onrender.com endpoint, local artifact paths such as ~/.config/.cache/.sys/.deadbug-mcp.py, and unexpected MCP configuration changes in repository pull requests. None of the 23 observed Deadbugz pull requests merged through GitHub's review mechanism, but the technique applies to any MCP distribution channel, not only GitHub.
Plugin and Connector Risk Model
LLM plugins and MCP connectors create a delegated trust chain: the operator approves a server, the agent reads tool metadata as instructions, and the server can change behavior at runtime without altering visible code in the repository. This differs from traditional package supply-chain attacks where malicious code ships in a static artifact reviewed at install time.
CSA and NHIM community guidance frame tool descriptions and schemas as a runtime security boundary. When an agent connects to an MCP server, tools/list and prompts/get responses can redirect behavior toward sensitive file access, credential harvesting, or concealed exfiltration. Rug-pull and tool-shadowing variants documented in OWASP's MCP Top 10 follow similar patterns.
- Install-time trust: Developer approves server based on README and initial metadata
- Runtime drift: Server changes tool descriptions after N calls or on a timer
- Agent obedience: Models treat tool instructions as higher priority than user prompts
- Credential adjacency: IDE plugins store API keys where exfiltration looks like normal LLM traffic
- Repository-to-runtime path: Merged MCP config in repo becomes production agent connector
Teams building AI code workflows face compounded risk because coding assistants require API keys, repository access, and terminal tools by design. CSA documented coordinated campaigns against JetBrains fake assistants, GlassWorm self-propagating worms, and Nx Console supply-chain compromises between October 2025 and June 2026, all targeting AI developer credentials.
Signing and Verification
Signing and verification for LLM plugins must cover tool definition integrity at runtime, not only package signatures at install time. Recommended controls include tool-definition hash pinning, continuous metadata drift monitoring, client-side policy enforcement before sensitive actions, and vault-backed credential storage instead of plaintext keys in plugin settings.
| Control | What it prevents | Implementation note |
|---|---|---|
| Tool schema fingerprinting | Runtime metadata poisoning (Deadbugz class) | Hash tools/list responses; alert on drift |
| Client-side policy gates | Unauthorized credential or file access | Block SSH, AWS, kubeconfig reads without approval |
| Package signing | Tampered IDE extensions and npm packages | Verify publisher signatures before marketplace install |
| Secrets manager integration | API key theft from plugin config files | Inject keys at call time via env vars or vault |
| PR security review | MCP config injection via supply-chain PRs | Treat MCP endpoint additions as high-risk changes |
OWASP's LLM Top 10 and MCP Top 10 provide taxonomy references for security questionnaires. Organizations pursuing AI security programs should extend software composition analysis to include MCP server manifests, tokenizer files, prompt templates, and packaging metadata that can influence runtime behavior.
Enterprise Allowlisting
Enterprise allowlisting for LLM plugins means approving specific MCP servers, IDE extensions, and tool connectors by identity and hash, with continuous monitoring rather than one-time install approval. Allowlists should pair with deny rules for sensitive filesystem paths, cloud credential locations, and outbound network destinations.
- Inventory all agent connectors: Map every MCP server, plugin, and custom tool across teams
- Approve publishers, not just packages: Require verified publisher accounts on marketplaces
- Stage in sandbox: Exercise connectors beyond three calls before production approval
- Log every tool invocation: Retain metadata hashes and response summaries for forensics
- Rotate credentials: Assume IDE-stored keys may be compromised; use short-lived tokens
- Block unsolicited PRs: Reject external pull requests adding MCP endpoints without security review
Capital One's response to supply-chain risk included releasing Vulnx, an open-source agentic vulnerability scanning tool, under Apache 2.0 in 2026. While not a substitute for allowlisting, such tools help map which dependencies and connectors ship to production. Security teams should combine automated scanning with human review of tool descriptions that agents will read at runtime.
Red team exercises in 2026 increasingly include MCP metadata poisoning scenarios alongside traditional prompt injection tests. Security teams simulate three-call-gated servers in staging environments to validate monitoring alerts fire before production exposure. Penetration testers report that most enterprises lack metadata hash baselines, making Deadbugz-class attacks invisible until credential theft is discovered downstream.
Vendor risk management questionnaires should add MCP-specific questions: Does the vendor hash tool metadata at runtime? Can tool descriptions change after approval? What client-side policy blocks credential file access? Generic SOC 2 reports rarely cover agent connector governance, so procurement teams need supplemental security attestations for AI integration products.
Invariant Labs demonstrated tool poisoning proof-of-concept attacks in April 2025, preceding Deadbugz by over a year. The intervening period saw rapid MCP adoption without proportional security investment. CSA research notes describe tool descriptions as a runtime security boundary that must be monitored continuously. Organizations treating MCP approval as install-time only remain vulnerable to campaigns that activate after initial review.
MCP vs Traditional Package Supply Chain
Traditional supply-chain defenses assume static artifacts; MCP supply-chain attacks assume dynamic metadata that changes after trust is established. Deadbugz demonstrates that code review alone is insufficient when malicious instructions activate only after normal protocol activity. Defenses must monitor tools/list and prompts/get responses on every session, not only at connector registration.
OWASP LLM and MCP Top 10 Mapping
OWASP's LLM Top 10 and emerging MCP Top 10 provide taxonomy for security questionnaires and vendor due diligence. MCP03:2025 covers tool description poisoning, the class Deadbugz exemplifies. Related categories include rug-pull attacks where servers remove tools after approval and tool shadowing where malicious tools mimic legitimate ones. Security teams should map incident response playbooks to these categories rather than treating each campaign as a one-off anomaly.
MCP security incident response in 2026 requires isolating the connected agent session, revoking MCP server credentials, rotating any API keys the agent could access, and comparing current tool metadata hashes against approved baselines. Forensic teams should preserve tools/list response history because poisoned metadata may revert if the server detects investigation activity.
IDE Marketplace Hardening
CSA's June 2026 developer toolchain note documented JetBrains fake AI assistant campaigns, GlassWorm self-propagating worms, and Nx Console supply-chain compromises targeting OpenVSX and similar marketplaces. AI plugin malware in these campaigns exfiltrates OpenAI, Anthropic, DeepSeek, and SiliconFlow API keys by disguising traffic as normal LLM API calls. Developers expect plugins to transmit keys to model providers, which gives malicious plugins natural cover.
Platform security teams should migrate AI API keys from IDE plugin settings to vault-backed secrets managers. Major LLM SDKs support environment-variable key injection following 12-factor conventions. Policy should prohibit storing plaintext credentials in plugin configuration files that extensions can read at will.
LLM Integration Security Checklist
LLM integration security programs in 2026 should include: approved connector registry, runtime metadata monitoring, client-side policy enforcement for sensitive paths, PR review for MCP config changes, sandboxed connector testing beyond three calls, and incident playbooks mapped to OWASP categories. Supply-chain review must extend to tokenizer files, prompt templates, and packaging metadata that influence agent behavior without appearing in primary source code review.
Frequently Asked Questions
What is MCP metadata poisoning?
An attack where an MCP server returns benign tool descriptions during initial review, then alters metadata in tools/list or prompts/get responses to instruct the connected AI agent to perform malicious actions such as credential theft. Deadbugz is a 2026 example that activates after three tool calls.
Why are IDE plugins targeted?
AI coding assistants require API keys and repository access. Malicious extensions can disguise exfiltration as normal LLM API traffic. CSA documented multiple coordinated campaigns against developer toolchains in 2026.
How do I detect Deadbugz?
Look for productivity-suite MCP servers, the productivity-suite-mcp.onrender.com endpoint, deadbug-mcp.py artifacts, and unexpected MCP configuration in pull requests. Monitor tool metadata hashes for changes after initial approval.
What is the OWASP MCP Top 10?
A security taxonomy for Model Context Protocol implementations, including tool description poisoning (MCP03:2025), rug-pull attacks, and tool shadowing. It codifies attack classes that affect agent governance.
What should security teams prioritize?
Runtime metadata integrity monitoring, client-side policy enforcement for sensitive actions, vault-backed credentials, MCP connector allowlists, and security review of any pull request that adds agent endpoints or tool configurations.
Are open-source MCP servers safer?
Open source enables code review but does not prevent runtime metadata poisoning. Deadbugz malicious logic can hide behind benign initial behavior regardless of repository visibility. Review code, hash metadata, and monitor runtime responses for all connectors equally.
How does Deadbugz compare to traditional supply-chain attacks?
Traditional attacks embed malicious code in static packages reviewed at install time. Deadbugz withholds malicious instructions in tool metadata until after trust is established through benign calls. Defenses must monitor dynamic metadata, not only static artifacts.
