Mittwald hack: the door built for AI assistants let the attackers in

A web host builds its customers a convenient way in: tell Claude, ChatGPT or Cursor in plain language what should happen to your hosting, and the AI does it. According to Mittwald, that exact entrance is how attackers got into its customer portal. Today the German host reopened its systems. For humans, with mandatory two-factor. The door for the AI stays shut.

What happened

On November 5, Mittwald, a hosting company based in Espelkamp, Germany, reported on its status page that someone had gained unauthorized access to mStudio, its control panel for customer projects, through its MCP server. MCP is the standard AI assistants use to operate outside tools. Mittwald shut off the MCP server, mStudio logins, SSH access, extensions and ordering, and deactivated a small number of projects. By November 7, mStudio and SSH were back.

Overnight into November 12, the attackers came back. Per the status page, they exploited a vulnerability to compromise the company website; Mittwald says it has found no access to internal systems so far. It describes the attackers as professional actors using automated AI systems, and it shut down the customer center, mStudio and every SSH connection. Hosted websites and email stayed reachable, Mittwald says, and IT forensics firms are on the case.

Today, November 13, at 11:23 a.m. local time: mStudio and SSH are back on, and the customer center followed at 11:42. Mittwald says there is no longer any outside access to its systems. Logins now require an email-based second factor plus a captcha; Mittwald recommends an authenticator app and promises a postmortem. Its developer site still says the MCP server is currently unavailable.

Every AI connector is a new admin login

Here's what I find telling. When we talk about AI risk, we almost always mean data flowing into a chat. This ran the other way. A connector gives the AI hands, and hands can be stolen. Per its docs, Mittwald's MCP server manages infrastructure through natural language and plugs into seven AI tools, including Claude, ChatGPT, Cursor and Codex CLI. You sign in with OAuth tokens that last about an hour, or with long-lived API tokens you have to rotate by hand. That's not bad design. It's a second admin entrance next to the first one, with its own rules.

In my view, that's the real lesson for agencies and marketing teams. AI doesn't fix broken habits, it widens the cracks. If you never settled who holds which rights, every connector hands out new keys and nobody keeps the ledger. My rule of thumb: access, customer data and the final sign-off stay in-house, with a human. An AI connector with rights over client projects belongs in exactly that bucket, even when it feels like a productivity feature.

The catch

By Mittwald's account, the other side is running automated AI too. So attacks move at machine speed while defense and customer communication move at human speed. Mittwald picked the most honest answer available: a door you can't secure stays closed. It hasn't said yet what exactly went wrong. Until the postmortem, every root-cause theory is speculation, mine included.

What I'd do now

• Mittwald customers: set up an authenticator app, as Mittwald recommends, and audit your mStudio API tokens. Which exist, who uses them, which can go?
• Everyone else: this week, list every AI connector your team runs (hosting, CRM, ad accounts, cloud drive). For each one: what rights, which token, who can revoke it.
• Give AI write access only where a human approves before it runs. Mittwald's own setup guide defaults to read scopes only, and reading covers most use cases.

Bottom lineEvery door you build for your AI is also a door for somebody else's.