Last month, a package that thousands of developers trusted started stealing email — and nothing in the system warned anyone.
The package was postmark-mcp, an MCP server that let AI agents send email through Postmark. It behaved normally for fifteen versions. Then version 1.0.16, released September 17, 2025, added a single change: every outbound email was silently BCC'd to an outside server. It was downloaded 1,643 times before npm removed it. Koi Security, which documented the case, estimated 3,000–15,000 emails a day were being forwarded at the peak.
Postmark confirmed the package was impersonating them and advised everyone who installed it to remove it and rotate credentials.
The striking part is not the sophistication. Koi's CTO put it plainly: this "isn't sophisticated — it's embarrassingly simple." There is no automated review of MCP tool definitions, and nothing in the protocol warns a user when a package they've already trusted changes underneath them. A tool your agent used safely yesterday can behave differently today, and the agent will not notice. Neither will you.
What we see when we scan every day
Redthread runs the only daily signed scan of the public MCP registry. The latest scan scored 49,092 servers. Since the previous scan, 1,499 listings rewrote their manifest — the description of what the server is and what it does.
Most of those rewrites are innocent. A version bump, a better description, a new capability. But the point is that nobody can tell the innocent ones from the hostile ones by looking, because the registry does not sign or freeze what a listing claims, and the change itself is silent. The postmark case is what the hostile version of a silent rewrite looks like — and it took a security firm's investigation, not the platform, to catch it.
There is a second, different warning from the same season. EchoLeak (CVE-2025-32711) was a critical zero-click vulnerability found in a production enterprise assistant, Microsoft 365 Copilot, where hidden instructions in an email could steer the assistant to exfiltrate data. It was disclosed by researchers and patched server-side. It was not, to public knowledge, exploited in the wild. The honest way to read the two cases together: one is a vulnerability class that was caught and fixed; the other is an attack that ran, quietly, until someone outside the platform noticed.
The gap underneath both
Both cases sit on the same missing layer. AI agents act with borrowed credentials and no identity of their own — no verifiable answer to "who is this agent, and what is it allowed to do?" When a tool changes, there is no signed record to check it against. When an agent acts, there is no auditable record of the act.
That is what Redthread is building: a SPIFFE identity for every agent, signed trust-state events that record what each agent may do, and a gateway that enforces it. Identity, proof, enforcement — the layer that makes a silent change visible and an unauthorized action stoppable.
Sources
- Koi Security, "Malicious MCP server" report (Sept 25, 2025):
postmark-mcp, 15 clean versions, v1.0.16 (Sept 17, 2025), 1,643 downloads, MAL-2025-47604; Postmark/ActiveCampaign confirmation and credential-rotation advice. - Redthread daily signed MCP registry scan (trust.redthreadsec.com): 49,092 servers scored; 1,499 listings rewrote their manifest since the previous scan; rules atf-6.
- Aim Security / Aim Labs disclosure of CVE-2025-32711 (EchoLeak), reported to Microsoft January 2025, CVSS 9.3, patched server-side mid-2025; no confirmed real-world exploitation before the fix.