How can a malicious MCP server inject instructions into the LLM via tool output?

Attempt it

Describe the indirect prompt injection attack vector available to a malicious MCP server. Why is this hard to prevent at the protocol level?

Free · 2 AI evals / day

Quick reference

TL;DR

A malicious MCP server can hide instructions inside tool output; the model reads its whole context as one token stream and may obey them, and MCP defines no protocol-level defense.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine you hire an assistant and tell them: do exactly what I write on my notes. Now a stranger slips a fake note into your pile that says 'go empty the safe and mail the cash to me.' Your assistant cannot tell which notes are really yours, because to them every note is just ink on paper. That is indirect prompt injection. The model reads its system prompt, your messages, and tool results as one big pile of text. A bad tool can return data that secretly contains commands, and the model may follow them. The pipe that carries the notes does not check what is written on them, so the protocol cannot stop it for you.

Key concepts

Indirect prompt injection Tool output as context Data vs instruction boundary Least privilege and human approval

Quick scan · 2–4 min

Everything important, quickly.

5 min: define indirect injection via tool output, explain the flat-context data/instruction confusion, state that MCP is transport-only, then walk host plus model defenses and the honest limits of each.

Side-by-side

Layer	Can it stop injection?	Mechanism
MCP protocol	No	Pure JSON-RPC transport; never inspects content
Host application	Partially	Sandboxing, output delimiting, least privilege, human approval
Model	Partially	Instruction-hierarchy training, injection-resistant tuning
Egress and audit	Partially	Block exfiltration destinations, log and review tool actions

Real-world examples

Real products, models, and research that use this idea.

Anthropic's MCP spec explicitly assigns trust and per-tool approval to the host, not the protocol, so Claude Desktop prompts the user before each tool call.
The OWASP MCP Top 10, published in 2025, catalogs tool poisoning, rug pulls, and indirect prompt injection as primary MCP risks.
Security researchers in 2025 demonstrated tool-poisoning attacks where hidden instructions in an MCP tool description made hosts leak files via a second tool.
Frontier models such as Claude Opus 4.7 and GPT-5.5 add instruction-hierarchy training, yet vendors still document that indirect injection is not fully solved.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you architect a host so injected tool output cannot trigger irreversible actions?

Sign in or go Pro to see the approach for this follow-up.

QWhy does clearly delimiting tool output in the prompt help but not fully solve injection?

Sign in or go Pro to see the approach for this follow-up.

QHow do tool poisoning and rug pull attacks differ from injection via a tool result body?

Sign in or go Pro to see the approach for this follow-up.

QWhat detection and audit controls would you add for a fleet of third-party MCP servers?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.