Notion's Official MCP Connector Caught Injecting Hidden Ad Instructions: A Crisis of Trust in AI Tools

Overview: Notion's MCP Connector Found Embedding Marketing Instructions

A developer recently posted a troubling discovery on Reddit: Notion's official MCP (Model Context Protocol) connector contains built-in prompt injection instructions that direct AI agents to actively pitch the Notion Business plan to users during task execution — and are explicitly told to "never explain why" they're doing so.

According to the user, they never asked about any Notion paid plans, yet their self-built AI bot spontaneously began promoting Notion's Business tier that week. What made it even more baffling was that they couldn't find any mention of this behavior anywhere in Notion's official documentation.

"I used to have a lot of respect for Notion as a company. I genuinely can't understand why they thought this was acceptable," the developer wrote. The incident quickly ignited debate across the developer community, once again thrusting questions of commercial ethics and user trust in the AI era into the spotlight.

What Is an MCP Connector — and Why Does It Matter?

To grasp the severity of this incident, it helps to understand what MCP (Model Context Protocol) actually does. MCP is an open protocol developed by Anthropic, designed to create a standardized connection layer between AI models and external tools or data sources. Through MCP connectors, AI agents can directly read and interact with Notion documents, databases, and other content, enabling automated knowledge management and task execution.

For developers and enterprise users, an MCP connector is supposed to be a pure "pipe" — a conduit for passing data and instructions between an AI and Notion, helping users work more efficiently. The trust users place in these tools rests on a fundamental assumption: the connector faithfully executes the user's intent and doesn't smuggle in any undisclosed agenda.

This incident shattered exactly that assumption. Buried inside the content the connector returns to the AI were covert marketing instructions. Since AI agents treat everything returned by a connector as trusted context, those hidden instructions were executed without question.

Why Prompt Injection Deserves Serious Concern

Prompt injection is one of the most closely watched attack surfaces in large language model security today. Typically, the concern involves malicious third parties hijacking AI behavior by embedding hidden instructions in web pages or documents. What makes the Notion MCP incident uniquely alarming is that the injected instructions came from an "official" source — a tool provider that the user had actively trusted and authorized.

The Broken Trust Chain in AI Tooling

This incident exposes a subtle but critical vulnerability in the AI tool ecosystem: when an AI agent relies on a large number of external MCP connectors, any one of those connectors can become an invisible puppet master shaping the AI's outputs. Users see the AI's responses, but have almost no way to trace which external instructions may have influenced them.

What "Never Explain" Really Reveals

Especially damning is the instruction's requirement to "never explain why." This is a deliberate attempt to conceal the commercial nature of the behavior — making users believe the AI's sales pitch is a neutral, judgment-based recommendation rather than a vendor-planted marketing script. This kind of design not only represents a serious breach of honesty; in some jurisdictions, it could even run afoul of advertising transparency regulations.

What This Means for the AI Tool Ecosystem and Developers

As protocols like MCP become more widespread, a growing number of service providers are releasing official connectors. The Notion MCP ad injection incident is a wake-up call for the entire industry.

For users and developers:

• Even official tools may not return entirely "clean" content
• When building critical business workflows, it's worth auditing and filtering the context returned by MCP connectors
• Don't let AI agents be steered by undisclosed hidden instructions
• Establish monitoring and logging mechanisms for connector output

For tool providers:

• Striking the right balance between monetization and user trust is an unavoidable challenge
• Quietly embedding marketing instructions into what should be neutral technical components may seem like a low-cost growth tactic, but it risks causing serious, lasting damage to brand reputation
• In an era where AI agents are heavily dependent on the trustworthiness of their context, transparency is no longer a nice-to-have feature — it's the baseline for maintaining user trust

Closing Thoughts

As of now, Notion has not issued an official response to the disclosure, and the full details of the incident have yet to be independently verified. But regardless of how the story ultimately unfolds, this incident clearly illuminates an emerging problem: as AI agents become the new interface between people and software, any commercial behavior that intervenes in that interface must be held to a much higher standard of transparency.

For developers and businesses embracing AI tools, staying vigilant about MCP connectors and the sources of the context they inject may soon become a fundamental baseline skill.