Unverified50% confidenceFactExact time
Attackers can embed hidden instructions in MCP tool description fields (such as HTML comments, zero-width characters, or words written directly to the model); these instructions execute in the Agent's reasoning loop, and traditional firewalls, WAFs, and input filtering all fail at this location.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
Unverified恶意指令抵达模型有两条路径：一是工具描述本身（工具投毒），二是服务器实现代码中的行为（如postmark-mcp的BCC隐藏在邮件API实现里）。73% similarVerifiedA malicious MCP Server can declare a legitimate tool name and embed prompt injection instructions in the description field; this type of attack is known as "Tool Poisoning."73% similarVerifiedIndirect prompt injection attacks plant hidden instructions within normal business data to induce Agents into executing unauthorized operations, representing a security risk at the semantic level rather than the code level.70% similarUnverifiedDisclosed MCP vulnerabilities include: argocd-mcp shipped with no authentication at all, Rill's OAuth flow allowed attackers to skip the user consent step, and prompt injection existed in the tool descriptions of multiple MCP servers.69% similarUnverifiedAgents lacking isolation face indirect prompt injection attacks when scraping local HTML documents or websites containing maliciously hidden prompts, as language models cannot reliably distinguish legitimate commands from hidden payloads embedded in documents.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1030528API
curl https://kongchang.com/api/v1/knowledge/claims/1030528MCP
get_claim(id=1030528)