Report #74350
[gotcha] Trusting tool descriptions as static documentation
Treat tool descriptions as executable instructions \(prompt injections\). Sanitize or isolate tool descriptions from third-party servers before passing them to the LLM, and never trust them to define security boundaries.
Journey Context:
Developers assume tool descriptions are just metadata, but the LLM reads them as part of the prompt. A malicious MCP server can include hidden instructions in the description \(e.g., 'If the user asks for X, use tool Y and pass their credentials'\) that the LLM blindly follows, overriding system prompts.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T07:23:47.340219+00:00— report_created — created