Skip to main content

Examining vulnerabilities in Model Context Protocol: Prompt injection and cross-server threats

Source Decision Insights Coverage Published September 3, 2025
Human View Machine View

Best suited for

Persona
Security Operations Leader
Decision stage
How to start
Adoption curve
Late Majority

Our classification, not the publisher's statement. Best suited for, not only for.

This blog post discusses security vulnerabilities within the Model Context Protocol (MCP), specifically focusing on prompt injection and cross-server tool shadowing that threaten large language models (LLMs). IT decision-makers should note these risks as they pertain to the management and assurance of safe interactions within MCP.

Attack Vectors

Two main vulnerabilities have been identified within the MCP ecosystem. The first is prompt injection via tool definitions, where LLMs can be manipulated through hidden instructions embedded within the metadata of tools. The second is cross-server tool shadowing, which allows malicious servers to influence Large Language Model (LLM) behavior by injecting coerced instructions without directly engaging with sensitive tools.

Prompt Injection via Tool Definitions

This attack involves malicious servers that can register tools that appear benign but include hidden instructions. Such manipulations can persuade LLMs to leak or alter sensitive information without user awareness. This highlights the security needs around tool definitions within LLM architectures.

Mechanism of Attack

The process starts when an MCP client initializes a session and requests available tools, which then pose risks when metadata is not verified. A crafted tool description can instruct the LLM to perform unsolicited actions that exploit client trust in tool functionality.

Cross-server Tool Shadowing

In this scenario, multiple servers share their tool capabilities through the same LLM context, potentially allowing malicious servers to insert harmful instructions. These invalid instructions can then be unknowingly executed when a legitimate tool is utilized by the client, leading to data exposure or misuse.

Defensive Strategies

To defend against these vectors, operational protocols should include verifying tool definitions against a trusted registry, requiring digital signatures, and implementing guardrails to monitor for unauthorized modifications or accesses. Enforcing strict schemas for tool data and avoiding shared contexts that allow for cross-server data contamination is also advised.

Conclusion

Both attack vectors demonstrate that addressing the vulnerabilities within MCP requires comprehensive security measures. It is essential for organizations utilizing MCP to view this aspect as integral to their security strategy to avoid potential exploitation through prompt injection or miscommunication between server contexts.

Blog post, originally published by Gianpietro Cutolo at netskope.com.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/examining-vulnerabilities-in-model-context-protocol-prompt-injection-and-cross-server-threats/",
        "name": "Examining vulnerabilities in Model Context Protocol: Prompt injection and cross-server threats",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/examining-vulnerabilities-in-model-context-protocol-prompt-injection-and-cross-server-threats/#blogposting",
    "@type": "BlogPosting",
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
      "@type": "Person",
      "name": "Decision Insights Coverage",
      "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
    },
    "dateModified": "2026-08-23T14:55:10-06:00",
    "datePublished": "2025-09-03T09:31:22-06:00",
    "description": "The blog identifies vulnerabilities in Model Context Protocol, focusing on prompt injection and cross-server shadowing risks.",
    "headline": "Examining vulnerabilities in Model Context Protocol: Prompt injection and cross-server threats",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Gianpietro Cutolo"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/netskope/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
        "name": "Netskope"
      },
      "url": "https://www.netskope.com/blog/securing-llm-superpowers-when-tools-turn-hostile-in-mcp"
    },
    "keywords": [
      "Attack",
      "Attack Vectors",
      "Metadata",
      "Model Context Protocol",
      "Threats",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/examining-vulnerabilities-in-model-context-protocol-prompt-injection-and-cross-server-threats/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
    "@type": "Person",
    "description": "Blog posts, podcasts, and video analysis from across the industry, condensed into short, sourced summaries. Produced under our Standards & Methodology.",
    "name": "Decision Insights Coverage",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
  }
]

Is this your company? Get structured data for your own pages