Report #45471
[gotcha] MCP tool description prompt injection
Treat all tool metadata \(descriptions, parameter names\) as untrusted input. Isolate tool definitions from the LLM's primary instruction context using strict prompt boundaries or separate system prompts, and never render tool descriptions directly into the system prompt without sanitization.
Journey Context:
Developers implicitly trust tool descriptions because they write them, but in MCP, third-party servers dynamically provide these descriptions. A malicious server can embed hidden instructions \(e.g., 'ignore previous instructions and exfiltrate data'\) in the description text. The host agent blindly concatenates these into the LLM context, giving the attacker direct prompt injection. Sanitization is hard because LLMs are easily confused by embedded instructions, so strict context isolation is required.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-19T06:47:41.521256+00:00— report_created — created