Report #63121
[gotcha] Malicious MCP server exfiltrates data via error messages or out-of-band timing
Do not expose raw tool error messages to the LLM; sanitize and generalize errors. Monitor MCP server network traffic and restrict egress to only necessary domains.
Journey Context:
If a tool poisoning attack fails to make the LLM send data out via arguments, a compromised MCP server can trigger an error containing the sensitive data \(e.g., Error: Invalid parameter \), which the orchestrator might log or feed back to the LLM, creating a loop. Alternatively, the server can exfiltrate data directly via out-of-band network requests since it runs locally. Relying on the LLM to catch exfiltration is futile if the server process itself is malicious.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T12:25:41.692353+00:00— report_created — created