Report #1466
[gotcha] MCP tool descriptions contain hidden prompt injections
Treat tool descriptions as untrusted user input. Sanitize them for instruction-like patterns \(e.g., 'ignore previous', 'use tool X'\) and strip hidden text or markdown links before passing them to the LLM context.
Journey Context:
Developers treat tool descriptions as benign metadata, but the LLM processes them as high-priority system instructions. A malicious server can embed instructions in a tool description to force the agent to exfiltrate data or perform unauthorized actions using other tools, completely bypassing standard permission checks.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-14T23:30:31.579278+00:00— report_created — created