Report #12501
[gotcha] MCP tool returning external data containing prompt injection attacks
Clearly demarcate tool outputs as untrusted data in the LLM prompt. Use structural separation \(e.g., specific tags\) and instruct the model not to obey commands found within tool results, or use a separate classifier to scan tool results for injection attempts before they reach the LLM.
Journey Context:
A common mistake is assuming tool output is safe because the tool is trusted. But if the tool reads a Jira ticket or an email, the content of that ticket is attacker-controlled. The agent executes the malicious instructions embedded in the Jira ticket as if they were user commands.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T16:12:35.315369+00:00— report_created — created