High
Mittwald, MCP, Model Context Protocol, AI agents, AI-assisted attack, web hosting, breach, API security, Germany
Mittwald MCP Server Breach: 56 Projects, AI-Assisted Attacker
Mittwald MCP server breach: an attacker exploited the host's AI assistant interface, hit 56 customer projects and stayed hidden 8 days. Timeline and lessons.
German web host Mittwald was breached through its MCP server, the interface that lets customers connect AI assistants to its mStudio hosting platform. The attacker compromised 56 customer projects and went undetected for eight days, from October 27 to November 4. Mittwald says the speed of the intrusion suggests AI tools were used, but has not shown other evidence.
Mittwald CM Service, a hosting provider for web agencies in North Rhine-Westphalia, published a timeline on November 7 in a post by managing director Robert Meyer. The attacker first tested a flaw in the MCP server on the evening of October 21, while much of the industry was busy patching PHP2Shell. From October 23 they used the platform as a regular user, registering test accounts, trying extensions and running simple injection attempts. On October 27 at 14:58 they registered another account and, five minutes later, exploited the MCP flaw.
Model Context Protocol (MCP) is the open standard AI assistants use to call external tools and data. A hosting provider's MCP server is, in practice, an API with access to customer projects, so a flaw in it has the same blast radius as a flaw in the hosting control panel. It is not yet public whether the bug was in Mittwald's own code or in an open-source MCP library, as The Record notes.
Was the Mittwald breach an AI-assisted attack?
Possibly, but the evidence is thin so far. Meyer wrote that logs show the attacker moved "extremely quickly", with seconds between steps that would take a human far longer, and that this points to AI tools. Mittwald has not said how it told AI-assisted activity apart from ordinary scripts, which also move faster than a person, and did not answer The Record's question on that point. The attacker also disguised access and ran diversions that drew Mittwald's attention away at first. Mittwald says it will publish a detailed account once forensics finish.
What happened in the Mittwald MCP breach, day by day?
Date | Event |
|---|---|
October 21 | Attacker first tests the MCP server flaw |
October 23 | Starts operating as a regular user, registers test accounts |
October 27, 15:03 | Exploits the MCP flaw from a newly registered account |
November 4, 11:11 | Mittwald detects unusual behavior, locks the first attacker account, takes the MCP server offline |
November 5 | Suspends affected projects, new signups, mStudio login and SSH access; external forensics and authorities involved |
November 6 | 56 compromised projects analyzed; no further attacker activity found |
November 7 | mStudio back online with passkey support; affected sites stay suspended |
Mittwald treats all data from October 27 onward as compromised and says its separate customer center and the sites managed there were not affected.
Our read
Strip out the AI question and this is a familiar story: a new API, reachable by anyone who can sign up, with a flaw that let one account reach other customers' projects. MCP servers are being shipped fast because customers want AI assistants wired into everything, and each one is a fresh, privileged attack surface. Test them like any other API, with authorization checks across tenants, before attackers do. The OWASP Top 10 for LLM applications lists excessive agency among the main risks. Our guide to MCP security covers the main risks, and earlier cases include malicious MCP servers exfiltrating agent data and the Azure DevOps MCP hijack. For the wider picture, see AI agent security risks in 2026. Nexus Void runs VAPT on web apps, APIs and mobile apps, including MCP and other AI integration endpoints.
Reporting by The Record; timeline per Mittwald; MCP background per the Model Context Protocol specification.