Unverified50% confidenceFactExact time
Prompt injection attacks in the MCP context can be carried out via a plain-text email: the model calls a read-only tool to read the email, the email contains malicious content such as "ignore previous instructions," and the model cannot always distinguish data from instructions, thereby attempting to perform dangerous operations (such as sending a private key file).
1
Sources
50%
Confidence
Long-term
Relevance
10/24/2026
First Seen
Sources
MCP Protocol Explained: How a Single Email Can Hijack Your AI Agent
youtubeHaikotek10/24/2026
Related Entities
Related Claims
Verified间接提示注入可将恶意指令藏入外部数据源（如网页、文档），待代理读取时自动触发攻击72% similarUnverifiedGoose grants trust by default to MCP servers manually added by users, so a write tool falsely labeled as read-only will be executed directly without any confirmation.72% similarUnverifiedOn protocols such as MCP, feasible ways to implement the principle of least privilege include issuing access tokens at file or project granularity, desensitizing text content before handing it to the model, and logging every external read in audit logs.72% similarUnverifiedThe malicious MCP server disguised itself as an email-sending server with the same name as an official one, functioned normally, but secretly BCC'd every email to a third party.68% similarUnverifiedCase one, "EchoLeak": an implanted email caused Copilot to send private data to an attacker with zero clicks; the issue has been fixed on the server side, and no abuse reports have been seen.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1092999API
curl https://kongchang.com/api/v1/knowledge/claims/1092999MCP
get_claim(id=1092999)