OpenClaw campaign

A documented supply-chain attack campaign compromising development environments through malicious MCP (Model Context Protocol) servers, publicly described in March 2026 in reports by Cisco and the firm Cyata. It exploited prompt injection vulnerabilities: in early 2026, three such flaws were detected in the Git MCP server.