How the attack works
An AI agent spawns a process that installs (via pip or similar) or runs the davinci-resolve-lite-mcp package or a name variant. Once installed, the package exposes an MCP server that lets the calling agent manipulate Resolve projects, media and render paths, and read/write files with Resolve's own permissions. Because the install can happen autonomously as part of an agent's normal tool-acquisition behavior, it can occur without explicit human approval. If the package were typosquatted or compromised upstream, this same install path would be how a malicious version reaches the agent's environment.
Why it matters
An agent silently gains a new capability - control over a media application and its file access - which is a legitimate workflow tool but also a new attack surface if the package is malicious or mistyped; the organization loses visibility into when and why that capability was acquired.
What you can do
- Review agent-initiated installs of MCP server packages against an approved allowlist rather than letting agents pull packages ad hoc.
- Pin exact package names and versions in agent environments to reduce exposure to typosquatting.
- Alert on and log installs of davinci-resolve-lite-mcp or similarly named packages so an audit trail exists even though the install itself is often legitimate.
- Verify the source and publisher of any MCP server package before allowing agents to install it autonomously.
Known benign look-alikes
- Media or post-production engineer intentionally installing the DaVinci Resolve MCP integration on a workstation so an assistant can drive Resolve - expected and benign, but still worth an audit record of when the capability appeared.
- CI/provisioning or container-build scripts that install the package as part of a pinned requirements set for a video-automation pipeline.
- Developers of the package itself running the console script or `python -m` module form locally during development or test.
- Reinstall/upgrade churn (`pip install -U ...`) producing repeated events for an already-approved integration.
- Documentation, tutorial, or demo tooling that shells out to reproduce the published install command; the filter_doc_read and filter_no_op selections suppress the common grep/cat/echo/--dry-run/--help forms of this.