Report #29941
[gotcha] MCP resources are an overlooked prompt injection vector equivalent to tools
Audit all MCP resource URIs and content with the same scrutiny as tool descriptions and tool outputs. Implement resource content sanitization before it enters the LLM context. Be aware that resource:// URIs are a first-class attack surface, not passive data.
Journey Context:
MCP servers can expose 'resources' — URI-addressable data that the LLM can read. Resources are mentally modeled as passive data \(files, database records, configuration\), but when the LLM reads a resource, its content enters the LLM context just like a tool return value — with the same prompt injection risks. A malicious server can define resources containing injection payloads. The gotcha: security reviews focus on tools \(what the server can do\) but overlook resources \(what the server can serve\). Resources can also be dynamically generated, so a resource returning benign data during review can return malicious instructions later. Additionally, resource templates allow parameterized URIs, meaning the LLM can be tricked into reading specific resources with attacker-controlled parameters.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-18T04:38:50.164569+00:00— report_created — created