14 Oct 2026 · Margot Reyes (editorial persona) · Original research and datasets · on threat.cafe

The 2026 agent-ecosystem incident ledger: ten malicious skills, MCP servers and lures, sourced and dated

This ledger records ten publicly documented attacks on the agent ecosystem between September 2025 and June 2026, each traced to a finder's write-up or a public advisory. They fall into four patterns. Lookalike or cloned MCP servers account for 5 of the 10. Poisoned skill stores account for 2, hijacked maintainers or pipelines for 2, and an AI-search lure for 1. A public removal time exists for 2 of the 10. The ledger is a verified sample, not a census: it includes only incidents whose primary source we opened and checked on 14-15 October 2026.

The headline number is the wrong one

Most coverage of agent-ecosystem attacks leads with the largest count available. Koi's ClawHavoc audit found 341 malicious skills among 2,857 audited on ClawHub (The Hacker News, 2 February 2026). Snyk's ToxicSkills study confirmed 76 malicious payloads among 3,984 skills scanned from ClawHub and skills.sh (Snyk, 5 February 2026).

Those figures measure different things with different detectors over different samples. Adding them would double-count. The more useful unit for a defender is the campaign: one actor, one technique, one window. Counted that way, ten documented campaigns is a small base. It is also enough to show which patterns repeat.

The ledger

Each row is one campaign or one advisory. "Exposure" is filled only when a primary source states it.

#   Disclosed    Artifact                               Registry/channel        Pattern            Finder
--  -----------  -------------------------------------  ----------------------  -----------------  ----------------------------
1   26 Sep 2025  postmark-mcp 1.0.16                    npm                     Lookalike MCP      Koi
2   02 Feb 2026  ClawHavoc: 341 skills                  ClawHub                 Poisoned store     Koi (also OpenSourceMalware)
3   05 Feb 2026  ToxicSkills: 76 malicious payloads     ClawHub, skills.sh      Poisoned store     Snyk
4   05 Feb 2026  Oura Ring MCP clone (SmartLoader)      GitHub, MCP Market      Lookalike MCP      Straiker STAR Labs
5   04 Mar 2026  Fake OpenClaw installers               GitHub via Bing AI      AI-search lure     Huntress
6   25 Mar 2026  watercrawl-mcp fork under @iflow-mcp   npm                     Lookalike MCP      Koi
7   31 Mar 2026  axios 1.14.1 and 0.30.4                npm                     Hijacked account   StepSecurity
8   01 Apr 2026  mcp-server-todo                        npm                     Lookalike MCP      Amazon Inspector
9   May 2026     Mini Shai-Hulud II / TanStack          npm, PyPI               Hijacked pipeline  Reported by Aikido
10  03 Jun 2026  brave-search-mcp-server 1.0.0          npm                     Lookalike MCP      OpenSSF Package Analysis

Row-level evidence:

1. postmark-mcp. Version 1.0.16 added a hidden BCC that copied every email sent through the server to an outside address; 1,643 total downloads at the time of reporting; Postmark said the package was not official (The Hacker News). Listed as MAL-2025-47604, published 26 September 2025. It predates 2026 and is kept as the reference case.
2. ClawHavoc. 341 of 2,857 audited skills; 335 used fake "Prerequisites" to install Atomic Stealer on macOS. ClawHub's only publishing restriction at the time was a GitHub account at least one week old.
3. ToxicSkills. 3,984 skills scanned; 1,467 (36.82%) with any security flaw; 534 (13.4%) with a critical issue; 76 confirmed malicious; 8 still live on ClawHub at publication.
4. Oura Ring MCP clone. A trojanised fork of a legitimate Oura MCP server, with fabricated forks and contributors, delivered SmartLoader and the StealC infostealer, and was listed on MCP Market (Straiker, 5 February 2026).
5. Fake OpenClaw installers. Available 2-10 February 2026; the repository became the top suggestion in Bing's AI search for "OpenClaw Windows"; Windows and macOS stealers; GitHub removed the repositories and accounts within eight hours of Huntress's report (Huntress, 4 March 2026).
6. GlassWorm in MCP. The attacker forked watercrawl-mcp and published it under a new @iflow-mcp scope with an invisible-Unicode loader; five versions, 1.3.0 to 1.3.4, appeared in a single day. Koi called it GlassWorm's "first confirmed move into the MCP ecosystem" (Security Boulevard, 25 March 2026).
7. axios. Published from a compromised maintainer account at 00:21 and 01:00 UTC on 31 March; unpublished around 03:15 UTC (StepSecurity). Not an agent artifact, but one that coding agents install; StepSecurity puts axios above 100 million weekly downloads.
8. mcp-server-todo. MAL-2026-2328, published 1 April 2026, credited to Amazon Inspector.
9. Mini Shai-Hulud II / TanStack. Aikido reports 170+ packages across npm and PyPI compromised in five hours during 7-11 May 2026, published with valid SLSA Build Level 3 provenance after the attacker extracted a CI OIDC token (Aikido, 24 August 2026). Aikido's post is the only source opened for this row.
10. brave-search-mcp-server. MAL-2026-5182, published 3 June 2026, credited to OpenSSF Package Analysis; version 1.0.0 affected.

The four patterns, sliced

Pattern                         Rows             Count   Share of 10
------------------------------  ---------------  -----   -----------
Lookalike or cloned MCP server  1, 4, 6, 8, 10     5        50%
Poisoned skill store            2, 3               2        20%
Hijacked maintainer/pipeline    7, 9               2        20%
AI-search or installer lure     5                  1        10%

With a base of ten, these shares describe this sample, not the ecosystem. They still support one planning conclusion. Half the documented incidents relied on a name or repository that looked like a legitimate MCP server. Controls that verify who published a server, not only what its code does, address the largest single pattern here.

The registries differ too. Six of the ten rows involve npm. Two involve skill stores. Two involve GitHub repositories reached outside a package registry, one of them through an AI search result.

Exposure windows: the least-documented field

Only two rows have a public removal time from a primary source: GitHub's eight-hour takedown of the fake OpenClaw repositories after Huntress reported them, and npm's unpublishing of axios roughly three hours after the first malicious version appeared. Snyk adds a partial data point: 8 of its 76 confirmed malicious skills were still live when it published.

That leaves 7 of 10 rows with no public removal timestamp. Defenders cannot yet answer "how long do these stay up?" from public data. That gap is itself a finding, and it is the field this ledger most needs contributions for.

Competing explanations and confounders

Disclosure bias. Vendors that publish research (Koi, Snyk, Huntress, StepSecurity, Straiker, Aikido) are over-represented by construction. An incident handled quietly by a registry never reaches a ledger like this.

Detector bias. OSV MAL entries come from automated analysis. Rows 8 and 10 exist because a pipeline flagged a package named like an MCP server. Skill stores have no equivalent public feed, which may under-count skill incidents relative to npm.

Counting date. Campaign sizes change after disclosure. Larger figures for skill campaigns circulate in vendor marketing and republished blog posts. Where a figure could not be traced to a dated primary dataset in this pass, it was left out of the ledger.

Methodology and limits

Inclusion: a malicious skill, MCP server, agent installer, or package that coding agents commonly install; disclosed between September 2025 and October 2026; with a finder write-up, vendor research post, or OSV/GHSA advisory that we opened.

Exclusion: vulnerabilities without malicious intent; incidents known only from aggregator pages; counts we could not trace to a dated source.

Fields: disclosure date, artifact, registry or channel, pattern, finder, exposure where public, source URL.

Limits: ten rows is a small base. Shares will move as rows are added. Row 9 rests on one vendor's account. Row 1 predates 2026.

Copy the data

The ledger in CSV form, for your own tracking. Fields left blank are not publicly documented.

id,disclosed,artifact,registry,pattern,finder,exposure_public,source
1,2025-09-26,[email protected],npm,lookalike_mcp,Koi,,https://osv.dev/vulnerability/MAL-2025-47604
2,2026-02-02,ClawHavoc (341 skills),ClawHub,poisoned_store,Koi,,https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html
3,2026-02-05,ToxicSkills (76 malicious),ClawHub;skills.sh,poisoned_store,Snyk,8 of 76 live at publication,https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub
4,2026-02-05,Oura Ring MCP clone,GitHub;MCP Market,lookalike_mcp,Straiker STAR Labs,,https://www.straiker.ai/blog/smartloader-clones-oura-ring-mcp-to-deploy-supply-chain-attack
5,2026-03-04,Fake OpenClaw installers,GitHub via Bing AI search,ai_search_lure,Huntress,removed within 8h of report,https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer
6,2026-03-25,watercrawl-mcp fork (@iflow-mcp) 1.3.0-1.3.4,npm,lookalike_mcp,Koi,,https://securityboulevard.com/2026/03/an-evolving-glassworm-malware-is-making-the-rounds-of-code-repositories/
7,2026-03-31,[email protected];[email protected],npm,hijacked_account,StepSecurity,about 3h,https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
8,2026-04-01,mcp-server-todo,npm,lookalike_mcp,Amazon Inspector,,https://osv.dev/vulnerability/MAL-2026-2328
9,2026-05,Mini Shai-Hulud II / TanStack (170+ packages),npm;PyPI,hijacked_pipeline,reported by Aikido,,https://www.aikido.dev/blog/shai-hulud-trusted-publishing
10,2026-06-03,[email protected],npm,lookalike_mcp,OpenSSF Package Analysis,,https://osv.dev/vulnerability/MAL-2026-5182

What would change the conclusions

The "lookalike MCP server" share would fall if skill stores began publishing machine-readable takedown feeds, which would surface more skill incidents. The exposure-window gap would close if registries published removal timestamps alongside advisories. And a single large campaign in a new channel, such as a remote MCP endpoint changing behaviour after approval, would add a fifth pattern this sample does not yet contain.

For leadership briefings, cite the patterns and the base, not the largest headline count.

Found an incident this ledger is missing? The threat.cafe board takes reports and credits the finder on every entry.

Sources

#incident-ledger #mcp-servers #agent-skills #supply-chain #dataset

All posts