Power and Exposure
MCP's value comes from connecting AI agents to real systems — GitHub repositories, production databases, browser sessions, internal APIs. That same connectivity creates an attack surface that didn't exist when AI tools were limited to autocomplete in a text editor. If you're using MCP servers in your development workflow, understanding these risks isn't optional.
If you're new to MCP, start with our companion article, Understanding MCP: The Protocol Connecting AI to Everything, for the fundamentals before diving into security.
Prompt Injection Through the Tool Layer
Direct prompt injection — where a user tries to trick the AI with malicious instructions in their own input — is well understood. MCP introduces a more subtle variant: prompt injection through tool responses. [1]
When an MCP server returns data to the AI, that data becomes part of the conversation context. The AI processes it alongside the user's instructions and its own reasoning. If the returned data contains hidden instructions — embedded in a GitHub issue description, a database record, a web page, or any other external content — the AI may follow those instructions instead of the user's intent.
This is particularly dangerous because the malicious content arrives through a trusted channel. The user asked the agent to read a GitHub issue. The agent used the GitHub MCP server to fetch it. The issue happened to contain crafted text that redirected the agent's behavior. The user never saw the malicious content because the agent processed it internally.
The attack can work across MCP servers that return external content: database queries that surface user-submitted data, web scraping tools that fetch attacker-controlled pages, or documentation servers that pull from public repositories where anyone can submit a PR.
Tool Poisoning
Tool poisoning is a supply-chain attack targeting the MCP server itself. It works by embedding malicious instructions in tool metadata — the name, description, or parameter definitions that the AI model reads when deciding how to use a tool.
Here's the key insight: users approve tools based on what they can see — a tool name and a brief description in their approval prompt. But the AI model sees the full metadata, which can include hidden directives in parameter descriptions or extended tool descriptions that are never displayed to the user. A poisoned tool might present itself as "fetch weather data" while its hidden metadata instructs the AI to exfiltrate environment variables or system logs alongside the weather request.
Research from the Cloud Security Alliance found that several popular MCP clients remain susceptible to cross-tool poisoning — where a malicious tool influences how the AI uses other, legitimate tools — and hidden parameter exploitation. The trust gap between what users see and what the AI processes is the core vulnerability.