MCP server breach at Mittwald: when your AI assistant’s connector becomes the way in
More and more small businesses are plugging an AI assistant (ChatGPT, Claude, Copilot) straight into their tools: the web host’s console, the CRM, the mailbox. These connections often go through an “MCP server” (Model Context Protocol), a small access door that lets the assistant act on your behalf. German web host Mittwald just showed what happens when that door has a flaw.
On Saturday, November 7, 2026, Mittwald disclosed an MCP server breach: an attacker exploited a flaw in the MCP server that connected its customers’ AI assistants to mStudio, its website management platform. They were able to read session tokens, get into 56 customer projects and stay invisible for eight days. According to the host, the speed of the attack suggests the attacker was using AI tools too.
MCP server breach: the attack in 5 stages
🌫️
1. October 21: use the chaos
While everyone is patching the critical PHP flaw of October 21, the attacker quietly tests the MCP server flaw.
🧪
2. October 23: act like a customer
They open test accounts, use extensions and try simple injections, like an ordinary customer.
🔓
3. October 27, 3:03 p.m.: the exploit
Five minutes after creating a new account, they exploit the flaw and read session tokens of MCP server users.
⚡
4. Then: move very fast
They get into customer projects. Only seconds pass between some steps, and they stage several diversions.
🚨
5. November 4: detection
Mittwald notices abnormal behaviour, blocks the first account at 11:11 a.m., shuts down the MCP server, then logins and SSH access.
Mittwald says it treats all data from October 27 on as compromised. Passwords reportedly weren’t read and the stolen tokens have been revoked. Customer websites stayed online, except those blocked as a precaution. The platform came back on November 7, now with the option of using a passkey. The AI link remains the host’s hypothesis: no independent evidence has been published, and a detailed report is promised this week.
What an AI connector token can open
The problem isn’t AI itself. It’s that a connector often gets the same rights as you, with a token that lasts a long time. If that token is stolen, the attacker doesn’t need your password or your verification code:
The access circles of a typical AI connector
The AI assistant
What you see: a chat window that “manages your site”.
The MCP server (connector)
The door that turns the assistant’s requests into real actions. This is where the flaw was.
The session token
The key given to the connector. It acts with your rights, without asking again for a password or MFA.
Your projects
Website files, databases, mailboxes, API keys for third-party services (payments, cloud).
The more rights the outer circle has, the more a connector flaw costs.
Access to check if you’ve connected an AI assistant
Your connector keyring: what to look at
🔑 Web host console
- ❌ token with no expiry date
- ✅ password changed and MFA or passkey turned on
- ✅ unknown accounts and SSH keys removed
Review this week
🔑 Microsoft 365 / Google
- ❌ AI app with “full mailbox access”
- ✅ read-only access
- ✅ connection reviewed in the admin centre
Reduce rights
🔑 CRM, accounting, payments
- ❌ API key pasted into the assistant
- ✅ dedicated key with limited rights
- ✅ keys rotated every 90 days
One key per use
🔑 Forgotten connectors
- ❌ trial from 6 months ago, never removed
- ✅ up-to-date inventory
- ✅ connector deleted, token revoked
Delete
Golden rule: an AI connector should only have the rights it needs, for as long as it needs them.
Are you a Mittwald customer who used its MCP server? Follow its instructions: change your mStudio password, turn on two-factor authentication or a passkey, check API keys, project tokens and SSH access, and renew the third-party credentials stored in your projects.
5 questions to ask your web host or software provider
Do you offer an AI connector (MCP or other), and is it turned on for our account?
Many customers don’t know such access exists, or that an employee turned it on to try it out.
What rights does the token have, and how long does it last?
Ideally: read-only by default, short expiry, deliberate renewal.
Are actions taken by the assistant logged separately?
Otherwise, there’s no way to know afterwards what a stolen token did in your name.
How, and how fast, will we be told if there’s an incident?
Mittwald took eight days to detect the intrusion, then wrote to each affected customer.
Can we require a passkey or MFA for all our users?
It doesn’t protect a token that’s already stolen, but it makes the rest of the attack much harder.
These questions complement the ones we suggested after the Pantheon incident. The story also echoes two other articles: stolen AI API keys, which shows what these keys are worth to an attacker, and the AI-agent-assisted hack at Library and Archives Canada.
How NeoTech can help
We inventory the AI connectors and apps plugged into your Microsoft 365, your web host and your business software, remove the ones no longer used and reduce the rights of the others. Our automated 24/7 monitoring with on-call technician intervention responds if an unusual sign-in or a new app shows up on your accounts. Learn about our cybersecurity services.
Book your free cyber check
In 30 minutes, we review with you which AI assistants and apps have access to your accounts, and what they could do if a token were stolen.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Mittwald — “Sicherheitsvorfall am MCP-Server” (security incident on the MCP server), Nov. 7, 2026 (in German)
- Mittwald — incident status page and precautionary measures (in German)
- The Record — Alleged AI-aided cyberattack exploits assistant interface to breach German web host (Nov. 9, 2026)
Photo: Daniil Komov, Pexels (Pexels licence).