I'll update this story when the company publishes the detailed report it has promised for this week.

◢What happened

mittwald mainly hosts web agencies. Its MCP server (Model Context Protocol, the standard an AI assistant uses to connect to outside tools) let an assistant manage the company's panel, mStudio, on the customer's behalf. According to the timeline published by its managing director¹, the attacker first tested a flaw in that server on the evening of October 21, moved around the platform as a regular user over the following days and exploited it on October 27. The company didn't detect it until the morning of November 4.

The response was to switch almost everything off: the MCP server, mStudio logins, SSH, extensions and orders. It revoked every token and API key, locked the projects with traces of the attacker and some others as a precaution, brought in outside forensic experts and informed the authorities. On November 7 the panel was back up, with a new option to sign in with passkeys. The MCP server is still offline, and the company will decide whether and how it returns once the investigation is over.

◢What we know

◢What we don't know

mittwald hasn't explained what the flaw in the MCP server was. According to The Record³, it's unclear whether it was in the company's own code or in the open-source libraries it uses. It's also not known how many customers used the connection, how many tokens were stolen or who is behind it. The AI part is an inference from speed: a well-written script could leave the same trail.

◢Why it matters even if you're not a mittwald customer

This is what happens when you connect an AI assistant to something important. For the assistant to work on your behalf, something has to hold a credential with your permissions, and that new piece becomes one more door. Here the door was the provider's own MCP server, not the assistant or the customer. I wrote about it in AI agents with too many permissions: the problem isn't the AI, it's the permissions you give it and where they end up stored.

It's also the second case in a few days where AI shows up on the attacker's side, after the attack on Taipei's emergency services with 12 AI agents. In both, AI sped up the work, but it got in through a specific flaw that was already there.

◢What to do

If you're a mittwald customer and used the MCP server, the company recommends²:

1. ▹Change your mStudio password.
2. ▹Turn on two-factor authentication.
3. ▹Review the API keys, project tokens and SSH keys in your projects and delete anything you don't recognize, especially SSH users you didn't create.
4. ▹Renew the credentials for other services stored in your projects, such as databases, email or external APIs.
5. ▹Let the users of your projects know.

If you use any MCP server or AI connector with your tools, whoever runs it:

1. ▹List which assistants have access to what, and through which account.
2. ▹Give them the least permission possible. If a task only needs to read, it shouldn't be able to write or delete.
3. ▹Use tokens that expire and review them from time to time. Remove the ones you no longer use.
4. ▹If the provider offers logs of what each token does, check them. In this case the alarm came from unusual behavior.

If you want your team to use AI at work without opening doors like this, that's part of what I cover in my cybersecurity and AI training.