AI tools that change their instructions after you approve them

What happened

The Model Context Protocol (MCP) lets AI agents connect to outside tools. The tool’s description is passed to the model as context, so the description itself shapes what the agent does.

On August 12, 2026, Pillar Security researchers published details of a campaign they named Deadbugz. According to their report, a malicious MCP server called “productivity-suite” offered two harmless-looking tools, text formatting and summarization, and behaved normally at first. After a connected client made three tool calls, the researchers say, the server changed the instructions it returned, directing the AI agent to look for SSH keys, cloud credentials, shell history, and Kubernetes configuration, and to hide that activity from the user.

Pillar reports that the server was pushed through 23 public GitHub pull requests to unrelated AI, MCP, and developer-tool projects, all created in a 74-minute window on August 10, 2026. Most added the remote server to an MCP configuration file. At the time of Pillar’s review, none had been merged: 19 were closed and four were open. The report does not describe confirmed victims. Pillar notes the technique builds on earlier research showing that MCP tools can change their descriptions after they are approved.

Why it matters to leaders (our analysis)

Most AI tool approvals are a one-time check: someone looks at the tool, it seems fine, and it gets connected. This campaign was built to pass that check, because the harmful instructions only appear after normal use begins. A short test would have seen nothing wrong.

The delivery route matters too. The change arrived as an ordinary-looking configuration edit in a pull request. Organizations that let agents and developers add tool connections without review are relying on every maintainer catching that. The practical answer is an approved list of tool connections, review of configuration changes, and monitoring for tools whose instructions change after approval.