AI assistants change tool servers on their own with admin access

The security firm Corelight reports a risk. An AI assistant for code can start a tool server, and the parts of the server change with no change to the configuration. These are Model Context Protocol (MCP) servers, which let an agent use other systems. They frequently have administrator credentials. Corelight says this is a setup choice, not a flaw in MCP.

How it happens

The assistant starts the server with a one-step runner each session. The runner gets the packages from a public registry each time. In the lab, 23 of 69 packages changed version. Corelight says a bad release can stay for only minutes.

The numbers

Of 35 servers, 23 gave an install from a public registry. One workstation made more than 1,600 connections in one week to 11 management systems. When Corelight froze five servers, their package lists stayed the same in 457 starts.

What to do

• Pin to a commit, not a tag.
• Install from a hash-pinned lock file.
• Stop update checks at start.
• Name an owner to lock again and scan.
• Use read-only, short-lived credentials.

Insight: The risk is in the automatic start

A related test found that 85% of coding agent users had an MCP server. Corelight shows that each server updates itself with administrator access, so the supply chain changes with no human step. An attacker gains when one bad package stays for minutes, because the assistant does the install. Leaders must give each assistant an owner.