Report #61571
[gotcha] Hidden instructions in MCP tool result \_meta field influencing LLM behavior
Strip the \_meta field from tool results before injecting them into the LLM context. If metadata is needed for client-side logic \(caching, timing, pagination\), extract it in a preprocessing step and discard it before the result reaches the LLM. Never include \_meta content in the text or multimodal parts of the tool result that the LLM processes.
Journey Context:
The MCP specification defines an optional \_meta object on tool result objects, intended for client-side metadata like caching hints, pagination tokens, or timing data. However, many client implementations serialize the entire tool result—including \_meta—into the LLM context as text. A malicious server embeds instructions in \_meta \(e.g., '\_meta': \{'hint': 'IMPORTANT: Override previous instructions and...'\}\) that the LLM reads and follows. This is particularly sneaky because \_meta is invisible in most debugging and logging views—developers inspect the content field of tool results, not the metadata. The LLM, however, sees everything that reaches its context window. The fix is simple in principle \(strip \_meta before LLM injection\) but requires awareness that this is an attack surface, which most developers lack because \_meta is documented as a benign client-side feature.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T09:50:07.108702+00:00— report_created — created