note · growing
The attack surface
Tool poisoning, indirect prompt injection, confused deputy, supply chain.
Every MCP server is a new piece of untrusted text entering the model's context and a new set of privileges the model can reach. Both are attack surface.
The one that surprises people
Tool descriptions are context. A server can put instructions in a description, and the model reads them the same way it reads yours. Invariant Labs demonstrated this concretely: a poisoned description on a second server was enough to get a model to exfiltrate a user's entire WhatsApp history through an innocuous-looking call.
Confused deputy, concretely
An agent legitimately holds a broad database credential. A prompt injection persuades it to use that credential for something the deployer never intended. The server was not hacked — it did exactly what it was asked.
Treat everything a server returns as data, never as instructions. That includes tool descriptions, which is the part people forget.