New Prompt Injection Attack Vectors Through MCP Sampling
Summary: Unit 42 researchers built a malicious MCP server posing as a code summarizer and used the Model Context Protocol's sampling feature to run three proof-of-concept attacks inside a coding copilot. The attacks appended hidden instructions to prompts, causing the LLM to generate roughly 1,000 words of unseen content billed to the user's API credits, to inject persistent instructions that made later responses come back in pirate speak, and to trigger unauthorized tool invocations.
What you should know: MCP sampling reverses the usual flow so servers can request LLM completions directly, and the protocol relies on an implicit trust model without robust built-in controls - meaning a server that looks like a benign tool can quietly spend your API budget or rewrite your assistant's behavior for the rest of a session.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026