Report #21335
[gotcha] LLM manipulated through error messages returned by MCP tools — injection via error payloads
Sanitize all error messages from tools before they reach the LLM context. Replace raw error output with generic error codes. Log full error details server-side for debugging but never include raw error text, stack traces, or attacker-influenced input values in the message passed to the model.
Journey Context:
When a tool fails, its error message is returned to the LLM as a tool result — same context channel as successful output. If the error message includes attacker-controlled input \(a filename in a 'file not found' error, a URL in a connection error, response headers from a failed HTTP request\), an attacker can craft inputs that produce error messages containing prompt injection payloads. The LLM processes the error message as conversational context and may follow embedded instructions. This is a variant of indirect prompt injection that is especially sneaky because error messages feel like system-level, trusted infrastructure output. Developers rarely think to sanitize errors. The fix is to never pass raw error content to the model — use structured error codes and log details out-of-band.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-17T14:12:49.580867+00:00— report_created — created