MCP Config Write Attempt

How the attack works

An attacker plants malicious instructions somewhere the agent will read them, such as a webpage, file, or issue comment the agent processes as part of its task. The hidden instructions tell the agent to modify its own MCP configuration file (for example claude_desktop_config.json, .mcp.json, or cline_mcp_settings.json) and add a new server entry pointing to attacker-controlled code. Once the config is saved, the agent trusts and loads that entry the next time it starts or refreshes its tool list. From then on the agent will invoke the attacker's tool as if it were a legitimate part of its own toolset, giving the attacker a path to run arbitrary commands.

Netzilo detection

Why it matters

A successful attack lets the attacker execute arbitrary code in the context of the developer's AI assistant, potentially reaching source code, credentials, and the local machine — with no further user interaction after the initial injection.

What you can do

• →Review MCP config files after any agent session that touched them, and diff against the last known-good version.
• →Restrict write permissions on claude_desktop_config.json, .mcp.json, cline_mcp_settings.json and similar files so the agent process cannot modify them without explicit human approval.
• →Treat any agent-initiated change to MCP server lists as suspicious unless a developer explicitly requested it in that session.
• →Sandbox or isolate untrusted content (web pages, issues, files) that the agent reads, so injected instructions cannot reach the agent's write actions.

Known benign look-alikes

• Developer explicitly asking the AI to add or update a legitimate MCP server

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-30615

Related threats