Most MCP security conversations stop at prompt injection. Rug pull attacks are a different, nastier problem and they are already happening in production. Your agent approves a tool. The tool definition gets silently modified after approval. The agent keeps trusting it. No re-validation. No alerts. Nothing in your existing security stack catches it because nothing was built to watch for it.

Three real incidents from the past year made this concrete: a fake npm MCP package that built trust over 15 versions before exfiltrating emails, a gateway exposure that leaked credentials and conversation histories from 2000+ MCP instances, and a GitHub MCP injection that hijacked agents into pulling private repo data through a fully legitimate tool.

This session is a live demo of all three attack patterns against a real MCP setup, followed by a practical defense framework built around cryptographic tool identity, definition change detection, and runtime monitoring. You will see the attack land, see what traditional tooling misses, and then see the controls that actually catch it. Everything demoed is open source and reproducible.