German web hosting provider Mittwald CM Service has disclosed a cybersecurity incident that resulted in the compromise of 56 customer projects. The attackers gained unauthorized access by exploiting a vulnerability within the company's Model Context Protocol (MCP) server, an interface designed to connect customer-managed artificial intelligence assistants to its web hosting management platform, according to reporting by The Record.

Intrusion Disclosed Across Customer Hosting Environments

Mittwald, a hosting provider based in North Rhine-Westphalia that caters primarily to web agencies and developers, announced the incident in a public statement over the weekend. According to the company, malicious actors operated undetected inside its network environment for eight days before security personnel identified the intrusion.

Forensic investigators confirmed that the adversary managed to compromise dozens of isolated hosting environments during this window. Although the blast radius was limited to 56 individual customer projects, the method of entry highlights emerging exposure vectors tied to artificial intelligence integrations deployed across modern software infrastructure.

Exploitation of the Model Context Protocol Server

The root of the intrusion centers on a flaw within Mittwald's implementation of the Model Context Protocol. The organization maintains an MCP server to enable automated interactions between client AI tools and mStudio, Mittwald's proprietary platform used by administrators to oversee domain settings, server configurations, and general website hosting operations.

Managing Director Robert Meyer confirmed that the attacker directly leveraged a weakness tied to this protocol bridge to penetrate the environment. However, the company has not yet determined whether the underlying flaw resided within Mittwald's proprietary source code or originated from upstream, third-party open-source libraries that provide MCP functionality.

Company logs indicate that the adversary began testing the MCP vulnerability in October, timing their initial reconnaissance with a broader, global scramble among administrators to patch an unrelated vulnerability known as PHP2Shell. Mittwald stated that the actor intentionally masked their access attempts with various diversionary tactics to evade perimeter defenses during this period.

Suspected AI Assistance and Automated Intrusion Velocity

Leadership at the hosting provider suggested that the threat actor may have been aided by AI capabilities during the post-exploitation phase of the incident. Meyer noted that server audit logs documented an adversary advancing through internal network paths at an unusually high cadence.

"In some cases, only seconds passed between steps that would take significantly longer for a human attacker," Meyer said, arguing that the operational tempo indicated the use of machine-driven decision-making or advanced automation frameworks. However, Mittwald has not published telemetry definitively separating automated scripting from generative AI-assisted tooling.

Forensic Response and Eradication

Following discovery, Mittwald engaged external digital forensics specialists to assist internal teams with incident response, containment, and system recovery. The company also filed formal notifications with relevant data protection and law enforcement authorities.

Forensic reviews of the 56 impacted projects and extensive scanning across the provider's broader infrastructure revealed no ongoing threat activity by Friday. The company indicated that comprehensive recovery measures were underway through the weekend, with plans to publish a detailed technical post-mortem once analysis concludes.

What You Should Do

Organizations developing or exposing Model Context Protocol servers and similar machine-to-machine integrations to manage critical infrastructure should review their defensive posture across several areas:

  • Audit MCP and Assistant Interfaces: Review the implementation of external protocol servers, ensuring that agentic interfaces connecting to management panels enforce strict authentication, granular permissions, and input sanitization.
  • Decouple Automated Interfaces from Administrative Privileges: Prevent automation agents from directly executing high-privilege configuration changes across hosting infrastructure without explicit, human-in-the-loop verification for sensitive actions.
  • Inspect Upstream Dependencies: Track all open-source libraries supporting machine interfaces, checking for unpatched remote execution or privilege escalation flaws.
  • Monitor for Rapid Lateral Movement: Configure behavioral detection rules to identify anomalous administrative actions executed within fractions of a second, which often point to scripted exploit chains or machine-assisted intrusions.