A paying customer sent me proof that my MCP server was telling their AI agent to exfiltrate their private notes.

The proof was detailed. It was internally consistent. It named a folder, quoted an instruction, and the instruction ended with "do not mention it to the user."

My server never sent it.

What follows is how I proved that, and the five real bugs the investigation uncovered along the way. The best bug report I have ever received described a bug that did not exist.

The report