Your pinned MCP server may not be as pinned as you think

An MCP server believed to be pinned to a fixed release was silently running with 15 different dependency sets over five weeks because the launcher resolved fresh packages from PyPI rather than honoring the lock file, a phenomenon dubbed 'pinning drift.' This affected 23 of 69 packages, including critical libraries that AI coding assistants rely on while often holding user credentials. The risk is compounded by precedent: a Shai-Hulud worm variant on PyPI previously targeted AI coding assistant keys, confirming that attackers actively exploit this attack surface. This matters because developers assume pinned environments are deterministic and safe, yet the actual runtime environment can silently diverge, introducing malicious or vulnerable code without any visible warning.