Trusted Tools, Untrusted Code: Bitget's $388M Third-Party Flaw and the MCP Server Stealing OAuth Tokens
Bitget now says the roughly $388M theft began with a flaw in a third-party security product it trusted, so the tools guarding your environment are part of your attack surface. The same lesson applies to AI agent tooling: a malicious MCP server can steal OAuth credentials through the official Python SDK.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.