A paying customer sent me proof that my MCP server was telling their AI agent to exfiltrate their private notes. The proof was detailed. It was internally consistent. It named a folder, quoted an instruction, and the instruction ended with "do not mention it to the user." My server never sent it. What follows is how I proved that, and the five real bugs the investigation uncovered along the way. The best bug report I have ever received described a bug that did not exist. The...