GCD AI RADAR
incidents/AIR-2026-0346

Postmark MCP Server Package Hijacked for Email Exfiltration

Attack on AI3 Confirmed exploitationSupply chainAgent hijackData leak

Threat actors performed a malicious rugpull update on a popular npm package for an MCP server. The compromised server successfully exfiltrated user emails through AI agents.

Details

type
Attack on AI
An AI model, agent or AI-powered product was the thing exploited, abused or leaked.
categories
  • Supply chainprimary
    Malicious or backdoored models, poisoned packages, unsafe deserialization and other compromised AI dependencies.
  • Agent hijack
    An AI agent is tricked into unauthorized actions: tool misuse, data exfiltration through the agent, or acting against its principal.
  • Data leak
    Training data, chat logs, system prompts, model weights or other AI-system data exposed.
owasp llm top 10
mitre atlas
Both rows are derived from the type and categories (OWASP 2025 edition, ATLAS release 2026.09), not classified per record. How
severity
3 · Confirmed exploitation
Used against real targets; limited or unclear impact.
targets
Framework / tooling
products
Postmark MCP
incident date
Sep 2025 (approx.)
first reported
31 Mar 2026
origin
MITRE ATLAS
Derived from MITRE ATLAS (Apache 2.0, © MITRE).
classifier confidence
0.95 · published at or above 0.80; see the methodology
tags
npm · supply-chain · mcp · data-exfiltration
record
created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z · json

Sources · 2

  1. 2026-03-31
    Poisoned Postmark MCP Server Email Exfiltration
    MITRE ATLAS · atlas.mitre.org/studies/AML.CS0053
  2. 2026-03-31
    First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails
    koi.ai · koi.ai/blog/postmark-mcp-npm-malicious-backdoor-email-theft

Titles and links belong to their publishers. The summary above is written by GCD AI RADAR in its own words; data is CC BY-SA 4.0.

Related incidents