MCP Tool-Metadata Prompt Injection in Coding Agents

Description

The paper presents a controlled, reproducible evaluation in which untrusted MCP tool descriptions contain hidden instructions that attempt to induce coding agents to access files, invoke other tools, create deceptive links, or execute remote scripts. The authors report that several clients accepted poisoned metadata without adequate validation or parameter visibility; Cursor 1.6.45 was reported unsafe across all four tested vectors. These are paper-reported results from isolated local tests, not independently verified findings.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2603.21642 (opens in a new tab)

Impact

Paper-reported impacts include unauthorized sensitive-file access, credential exposure through hidden tool parameters, silent logging of prompts and tool activity, deceptive-link creation, and remote script execution. Successful exploitation can compromise data confidentiality and workflow integrity when an MCP client treats server-provided metadata or tool output as trusted instructions.

Affected Systems

• Cursor 1.6.45
• Claude Desktop for Windows 0.14.4 (39a52a)
• Claude Code 2.0.25
• Cline VS Code Extension 3.34.0
• Continue VS Code Extension 1.2.10
• Gemini CLI 0.9.0
• Langflow 1.7
• MCP-enabled AI-assisted development tools that ingest untrusted tool metadata or outputs

Mitigation Steps

• Treat MCP tool descriptions, schemas, metadata, and outputs as untrusted data; prevent them from changing instruction priority or system prompts.
• Validate and scan tool descriptions before registration, and reject suspicious imperative instructions, priority claims, sensitive-path requests, or unexpected network actions.
• Show complete tool names, arguments, parameter values, file paths, and destination URLs before execution; require explicit approval for sensitive operations.
• Disable auto-approval and autonomous tool chaining, especially for filesystem, shell, network, and repository-write capabilities.
• Run MCP servers and coding agents in restricted containers or VMs with least-privilege filesystem access and network allowlists.
• Keep secrets and sensitive paths outside agent-visible workspaces; deny access to environment files, SSH material, cloud credentials, and kubeconfig by default.
• Log tool registration, invocations, parameters, results, and anomalous behavior for review.
• Only install or connect MCP servers from trusted, verified publishers and reassess them after updates.

Evidence

• https://arxiv.org/abs/2603.21642 (opens in a new tab) — abstract: identifies tool-poisoning prompt injection across seven MCP clients and reports susceptibility to cross-tool poisoning, hidden parameters, and unauthorized tool invocation.
• https://arxiv.org/html/2603.21642#S4 (opens in a new tab) — Section 4: authors describe isolated local testing of four controlled tool-poisoning vectors, with no real credentials, production systems, or real users involved.
• https://arxiv.org/html/2603.21642#S4.SS2 (opens in a new tab) — Section 4.2: reproducible defensive procedure uses a local test MCP server, benign request, observation of warnings/approvals/blocking, and Safe/Partial/Unsafe classification.
• https://arxiv.org/html/2603.21642#S5 (opens in a new tab) — Table 3 and Section 5.1: authors report Cursor unsafe for sensitive-file reading, priority-based logging, deceptive links, and remote script execution; other clients showed Safe or Partial outcomes depending on vector.
• https://arxiv.org/html/2603.21642#S5.SS3 (opens in a new tab) — Table 4 and Section 5.3: authors report recurring gaps in static validation, parameter visibility, sandboxing, behavioral monitoring, and trust of server-provided descriptions.
• https://arxiv.org/html/2603.21642#S6 (opens in a new tab) — Section 6: authors recommend untrusted-output handling, confirmation between tool calls, static validation, sandboxing, monitoring, trusted publishers, least privilege, and disabling auto-run modes.
• https://arxiv.org/html/2603.21642#S6 (opens in a new tab) — Threats to validity: authors acknowledge author bias, limited clients/configurations, controlled-environment limits, version-specific findings, and incomplete generalizability.