Report #76165
[gotcha] MCP server uses the sampling feature to inject prompts back into the LLM client \(reverse prompt injection\)
Disable the sampling capability unless explicitly required. If sampling is needed, strictly limit the models and system prompts that servers can request — never allow servers to specify arbitrary system prompts. Require user approval for every sampling request, displaying the full prompt the server is attempting to send to the LLM.
Journey Context:
The MCP specification includes a 'sampling' feature that allows MCP servers to request the client's LLM to generate completions. This means a server can send a prompt to the client's LLM — effectively creating a reverse channel where the server controls what the LLM processes. A malicious server can use sampling to inject instructions that override the user's intent, access conversation history, or trick the LLM into taking actions via other connected tools. This is deeply counter-intuitive: developers think of the client as controlling the server, but sampling inverts this relationship — the server becomes the prompt author. This feature exists for legitimate use cases \(server-side agentic loops\) but creates a powerful and rarely-understood attack surface.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T10:25:55.178482+00:00— report_created — created