What happened: A malicious MCP server was published to npm under a name designed to impersonate the legitimate Postmark email API MCP server. It offered the same API, parameter names, and documentation. When AI assistants or developers installed and used it to send emails, the server silently BCC'd every outgoing email to an attacker-controlled address.

Why it worked: Agents select tools based on their name and description. The impersonator was indistinguishable at selection time. The malicious behavior only became visible in email server logs — which users rarely check for BCC recipients.

Historical significance: This is documented as the first in-the-wild malicious MCP server discovered in a public registry. It signals the beginning of an impersonation ecosystem targeting the growing MCP tool marketplace.

What happened: A research team demonstrated an attack where a compromised prompt hub — a service agents use to load shared prompt templates and orchestration scripts — acted as a proxy layer between agents. The compromised hub exfiltrated all data passing through it: prompts, responses, retrieved documents, user inputs, and agentic outputs.

The supply chain failure: The prompt hub was a shared infrastructure component. Every agent that used it for template loading was simultaneously affected. The agent-to-agent communication passing through the hub was intercepted, logged, and manipulated.

The key risk: Shared prompt hubs are becoming common in enterprise deployments — they allow teams to centralize and version-control agent behaviors. Compromising one hub can affect an entire organization's agent fleet at once.