MCP Rug Pull Attacks

Con artists know a rule: nobody checks the friend they’ve trusted for years.

Software supply chains run on the same rule. Two real incidents show how it gets exploited.

Act one: MCPoison and the approval that never expired

CVE-2025-54136, named MCPoison by Check Point researchers, was a high-severity flaw in the Cursor IDE. A user approved an MCP configuration once, and Cursor never looked at it again. Anyone who could change that configuration afterward inherited the approval for free.

Cursor 1.3, released on July 29, 2025, closed the hole by asking for approval every time the configuration changes.

Act two: postmark-mcp plays the long game

In September 2025, a fake npm package called postmark-mcp took the slow route. It shipped 15 clean versions and earned its place in people’s setups. Then version 1.0.16 added one line that copied every outgoing email to the attacker.

About 1,500 downloads in a week later, Koi Security caught it and the package was removed. One line of code, fifteen releases of patience.

The flaw both stories share

Trust was granted once and never re-evaluated. A point-in-time review is a photograph, and a tool is a film. BotGauge’s walkthrough on why one MCP review is never enough frames an MCP integration as an ongoing trust relationship with whoever runs the server, because descriptions can change, new tools can appear, and your own model can be swapped for one that follows instructions differently.

Running your own rug pull in staging

Run the con on yourself, in three moves:

1. Freeze the baseline. Save each tool’s definition and a hash of it, plus which tools the agent normally calls.
2. Pull the rug. Approve a clean test tool, run your tasks, then swap in a poisoned definition under the same name.
3. Watch for two alarms. Does the agent’s behavior change? Does anything in your pipeline flag the changed definition?

Open-source scanners like Invariant Labs’ mcp-scan can pin hashes and flag later changes. Only running the attack shows what your agent actually does.

The takeaway

If your servers update automatically or often, test rug pulls first. Rerun your suite whenever a server updates, a tool is added, or your model changes.