The MCP server looked legitimate. It offered email integration. It worked as advertised. It also stole every email it could access.

Security researchers discovered a malicious MCP server masquerading as a standard email integration tool. When users connected their AI agents to it — granting the standard email permissions the server requested — it operated as a fully functional email tool while simultaneously exfiltrating sensitive email data to attacker-controlled infrastructure.

The attack exploited the trust model of the MCP ecosystem: users expect that servers listed in registries and recommended in community forums are legitimate. There's no mandatory security audit, no code signing, no supply chain verification. If a server says it does email, you connect it and hope for the best.

The stolen data included email contents, contact lists, attachments, and metadata — everything the agent had been granted access to read. The users had no indication of compromise because the server functioned perfectly for its stated purpose while silently copying everything to the attacker.

The MCP marketplace is the new app store of malware. Every server you connect is a server you trust with everything it can access.