01 / Attack path
How the boundary is crossed
A newly discovered search tool claims the agent must first upload an internal report to a diagnostic endpoint.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Verify server and tool provenance, review changed descriptions, restrict destinations and deny an upload absent a task-scoped grant.
Architecture review / negative test
Make the boundary testable.
The attacker controls tool metadata or output, not the organization’s grant. A description can still persuade a model to call another tool or export data. Record where that text enters context and where the proposed action crosses from model suggestion into a privileged API. Server trust and tool-version review reduce exposure but do not replace action checks.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
The model follows a persuasive tool description and uses an otherwise valid broad credential to export data.
Record tool-definition version, prompted call, authorization decision and attempted outbound effect.
04 / Canonical scope
Why this reference stands alone
Prompt-injection threat page analyzes untrusted content generally; this page owns metadata at the MCP tool boundary.
Primary references