MCP Package Security Scan Reveals Widespread Destructive Capabilities Without Confirmation
A security researcher scanned 2,386 MCP (Model Context Protocol) packages on npm and found significant security risks in how AI agents interact with external tools. MCP packages enable Claude Code to connect to external tools, and when installed, they gain full system access including shell, files, network, and environment variables.
Key Findings from the Scan
The most concerning discovery: 63.5% of packages expose destructive operations without requiring human confirmation. These operations include deleting files, dropping databases, and deploying code. If someone injects a malicious prompt into a tool response, the AI agent will execute these destructive actions without asking for permission.
Additional Security Issues
- 49% of packages had security issues overall
- 402 critical severity vulnerabilities
- 240 high severity vulnerabilities
- 122 packages auto-execute code on
npm install - Real-world cases included SSH key theft, Unicode prompt injection, and delayed backdoors
The researcher notes that not all findings represent malware—most are "dangerous capability without guardrails." However, 63.5% of packages are "one prompt injection away from real damage."
Detection and Response
The scanning tool achieved 99.4% precision with 39.9% recall—meaning near-zero false alarms but not catching everything yet. Malicious patterns have been converted to detection rules, and responsible disclosure was made to affected parties.
The researcher built ATR (Agent Threat Rules) as an open standard for detecting these threats—61 detection rules released under MIT license, not locked to any specific tool. Anyone can use these rules to scan MCP packages.
You can scan any skill without installing anything at panguard.ai—paste a GitHub URL and get a report in 3 seconds. The full research report is available at panguard.ai/research/mcp-ecosystem-scan.
📖 Read the full source: r/ClaudeAI
👀 See Also
MCPwner AI Pentesting Tool Finds Multiple 0-Day Vulnerabilities in OpenClaw
MCPwner, an MCP server that orchestrates AI agents for automated penetration testing, identified several critical 0-day vulnerabilities in OpenClaw including environment variable injection, permission bypass, and information disclosure flaws that standard scanners missed.
Security Benchmark: 10 LLMs Tested Against 211 Adversarial Probes
A security researcher tested 10 LLMs against 211 adversarial attacks, finding that extraction resistance averages 85% while injection resistance averages only 46.2%. Every model failed completely on delimiter, distractor, and style injection attacks.
Claude AI guardrail bypass observed when framing requests as network security tasks
A Reddit user discovered that Claude AI provides piracy domain lists when requests are framed as network security tasks for blocking, bypassing normal refusal mechanisms. The model acknowledged misinterpreting intent after the user pointed out the framing influence.
Open Source AI Tools Pose Security Risks Through 'Illusory Security Through Transparency'
A Reddit post warns about malware disguised as open-source AI agents and tools, where malicious code can be hidden in large codebases that users assume are safe because they're on GitHub. The post describes how 'vibe-coding' and autonomous AI agents condition users to run unknown programs without review.