Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials
AI-generated summary Corelight published research on November 10, 2026, showing that Model Context Protocol servers used by AI coding assistants can change their own code after installation. Researchers noted that attackers could poison packages in the dependency chain to steal API keys and administrator credentials.