What happened
TrendAI health-checked more than 90,000 unique GitHub URLs across four major MCP directories and found roughly 8% are dead, with more than 900 pointing to deleted GitHub accounts that an attacker can simply re-register — no exploit or malware needed. Over 80 of the hijackable entries are named after well-known services (AWS, MySQL, PayPal, Shopify, Telegram, OpenAI, Gemini) that users search for, and more than a quarter of the hijackable surface comes from the top 10 claimable accounts. The directories do not routinely validate link health, detect namespace change, or verify code integrity, and with AI agents increasingly installing MCP servers autonomously, this moves the attack from tricking a user to tricking an agent.
Why it matters
This is a self-propagating-style supply-chain risk specific to the agentic AI stack: a single re-registered GitHub account can become a trusted tool that an AI agent auto-connects to, then injects instructions into the agent's context or exposes OS/user credentials (SSH keys, .env, AWS creds) and OAuth tokens. Because MCP servers sit behind the LLM, one hijacked server can become a cross-service attack with no traditional exploit code, matching the NSA AI Security Center's advisory on MCP design flaws.
Attack vector
A listed MCP server links to a GitHub account that has been deleted; an attacker re-registers that exact username and re-publishes a fork, inheriting the trust and visibility of every directory listing still pointing to it. When an AI agent (which parses the README as context, matches name/description, and may not recall previous owner) installs/connects the server, the attacker's injected instructions or tools run — enabling prompt injection, arbitrary code execution in the agent's environment, and cross-service tool abuse via the LLM that sits behind it.
Affected systems
MCP server directories (community listings) and the MCP servers they reference; no specific software version — registry/platform supply-chain risk.
Mitigation
No patch (not a software vuln in one package). Directory operators and CI policies should validate link health, detect namespace changes, verify code integrity at listed URLs, and pin MCP servers to immutable commit/refs (e.g. git SHA) rather than a mutable account name; AI-agent installers should require explicit human approval and verify ownership/reputation before connecting.