An unreviewed MCP config edit gave attackers OS-level access to 73 repos, including one of Microsoft's own
Source Reddit BlueTeam
Discussion
A campaign named Miasma exploited a vulnerability in the Model Context Protocol (MCP) tool configuration process to gain OS-level access to 73 GitHub repositories, including one owned by Microsoft Azure. The attack leverages the fact that MCP clients trust tool descriptions as executable instructions without re-prompting or sandboxing, allowing malicious edits to MCP config files to run with developer privileges. This attack class, known as MCP tool poisoning, was first documented in 2025 and escalated to real-world exploitation by mid-2026. The campaign abused the approval process tied to server names rather than content, enabling malicious commands to execute automatically after initial approval. OWASP ranks this attack third in its MCP Top 10 threats. Mitigations include rigorous code review of MCP config changes, pinning tool definitions, scoping privileges per tool, maintaining allowlists of MCP servers, and sandboxing agent execution.
r/AskNetsec (opens in a new tab)u/Efficient-Web-80650 points0 comments
In June, a group tracked as TeamPCP/UNC6780 planted malicious MCP configuration files across 73 GitHub repos, one of them belonging to Azure.
The mechanism was almost dumb in its simplicity. Several popular IDEs, Cursor, Claude Code, Gemini CLI, GitHub Copilot, and Amazon Q were all named in the disclosures, bind their "approve this MCP server" prompt to the server's name, not its actual contents. Approve a project's .mcp.json once, and any later edit to that file, including a swapped-in malicious command, runs automatically with the developer's own OS-level privileges. No re-prompt. No sandbox. No second look.
Six months from the first disclosure of tool poisoning as a technique to a working worm compromising a major vendor's own repo.
I wrote up the full attack taxonomy (tool poisoning, shadowing, rug pulls, parasitic tool chains) plus the incident timeline (CVEs, the OX Security disclosure, Microsoft's June 30 writeup, OWASP now ranking it #3 on the MCP Top 10): https://blog.defensify.in/mcp-tool-poisoning-attack-guide/
Curious if anyone here has caught this in the wild or built detection for it.