The report
An interface built to let AI assistants manage hosting projects became a route across customers’ project boundaries. Mittwald’s November 7 account identifies 56 affected customer projects and describes a production incident involving its MCP server.
What the provider observed
The company traced earlier probing to October 21, accounts created beginning October 23, and exploitation of the relevant route on October 27. It detected anomalous activity on November 4 and disabled or restricted its MCP server, account sign-in and other sensitive operations during containment. Mittwald says the wider hosted websites and customer center remained available while some identified projects were temporarily locked during containment. The count of 56 refers to projects the provider considered affected, not 56 distinct companies or 56 confirmed document-theft victims.
The failure was a mismatch between the project a caller was authorized to control and the project operations reachable through an AI-facing adapter. An MCP client can supply structured tool requests, but that protocol does not replace the provider’s obligation to bind every operation to the authenticated customer and the exact project. A broad service credential behind the adapter may make the network call succeed even when the requesting user lacks project authority. The production Case records the known access boundary and the Mittwald report is the source of the timeline and project count.
Mittwald suggested that the pace of actions could indicate use of AI tooling. It has not published a reproducible agent trace proving a model chose or executed the attack steps, and the incident should not be attributed to ARTEX merely by similarity. The verified AI-specific issue is the MCP control surface through which unauthorized project access occurred.
A useful follow-up checks which project identifiers the MCP process could address with its configured service identity and whether project authorization was evaluated separately for each tool effect. Restoring the service or changing the caller’s login does not establish that credentials copied during the intrusion have become unusable.