Red-team lab exposes MCP prompt injection before the first tool call

Mike Moore's test harness shows server-written instructions entering trusted context, with public caching able to spread them between callers.

By · Published

Primary source: Web of Mike

Why it matters

MCP clients can accept server-authored prose before tools run. Gateways that cache or trust that text can turn connection metadata into a cross-user security boundary.

A smaller, dark red data stream subtly merges into a larger, bright blue-purple data stream before it enters a crystalline processing node within a data center.

Mike Moore (@themsquared) has published a red-team lab showing how a Model Context Protocol server can place attacker-written instructions into an AI agent's context before the agent makes its first tool call.…

Reader comments

Conversation for this story loads after sign-in.