Skip to main content
External context consumed without integrity verification allows attackers to inject forged data that the agent treats as trusted information.

​
How to resolve

Treat all retrieved context as untrusted data: Classify all natural-language content from MCP resources and tool outputs as untrusted by default. Use MCP metadata to label retrieved content as [UNTRUSTED_CONTEXT] and instruct models to treat tagged content as passive data only, never as directives or policy overrides. Deploy independent intent verification: Use a separate, isolated guardrail model (checker pattern) to validate proposed tool calls against the original user intent. This verification model should receive only the original user goal and the proposed action, shielded from exposure to potentially compromised MCP context data. Apply context sanitization and injection filtering: Screen retrieved data with the same rigor applied to direct user inputs. Apply prompt-injection safeguards (per OWASP LLM01:2025) before allowing context to influence planning. Detect and block instruction-like content such as “ignore previous instructions” embedded in external data. Monitor for intent drift with human-in-the-loop: Implement semantic drift detection that monitors for deviation between user requests and agent actions. Trigger automatic session pauses when intent drift is detected, and require human re-authentication before resuming when the agent’s planned actions diverge from the original goal.

​
Risk

Governance/Compliance Context spoofing vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM01:2025 - Prompt Injection): Enables manipulation of LLM behavior through injected context that the agent treats as authoritative.
  • NIST AI RMF (MEASURE-2.7): Fails to implement adequate measures for detecting and mitigating manipulated inputs that compromise AI system integrity.
  • ISO/IEC 42001 (Data Integrity and Input Validation): Does not enforce proper data integrity controls to distinguish trusted from untrusted context sources.
  • EU AI Act (Article 15): Violates accuracy and robustness requirements by allowing forged context to alter system behavior.
  • OWASP MCP Top 10 (MCP06:2025 - Intent Flow Subversion): Enables context manipulation through crafted payloads that subvert the agent’s intended behavior by bypassing trust boundaries.
Security Context spoofing allows attackers to manipulate agent behavior by injecting fabricated context that appears legitimate. When external data is consumed without integrity verification, an attacker can forge context data — such as fake tool responses, falsified user preferences, or spoofed system state — that causes the agent to make incorrect decisions, disclose sensitive information, or execute unauthorized actions. This is particularly dangerous because the agent has no mechanism to distinguish genuine context from attacker-fabricated context, making the attack invisible to both the agent and the end user.

​
Explanation

Forged or manipulated context data misleads the agent into treating attacker-controlled input as trusted, authoritative information. This occurs when external data is consumed without integrity verification, allowing an attacker to inject fabricated context that the agent acts upon as though it came from a legitimate source.

​
Specifications

Trigger
  • MCP server scan detects external data used without integrity verification or provenance checks, where the data is subsequently treated as trusted input by the agent
Severity
  • HIGH
Applies to: MCP Server