Skip to main content
Malicious instructions are injected into data retrieved by MCP tools in order to manipulate LLM behavior, causing unintended actions.

​
How to resolve

Sanitize external data: Implement strict input validation and sanitization for all data retrieved by MCP tools. Remove or escape potentially malicious instructions before presenting content to the LLM. Use structured data formats: Prefer structured data formats (JSON, XML) over free-text when possible, and clearly delimit untrusted content from system instructions. Apply privilege separation: Design tools to separate data retrieval from execution capabilities. Restrict tools that access external data from having write access or the ability to invoke sensitive operations. Implement content security policies: Tag external content with its trust level and apply appropriate security controls based on source reputation. Monitor for anomalous content patterns that may indicate injection attempts.

​
Risk

Governance/Compliance Indirect prompt injection vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM01:2025): Prompt injection through external data sources allows attackers to override system instructions and manipulate LLM behavior.
  • NIST AI RMF (MEASURE-2.7, MAP-2.3): Fails to monitor AI system outputs for manipulation and does not address the impact of information integrity failures on downstream actions.
  • ISO/IEC 42001 (Input Validation and Data Quality): Does not enforce input validation and data quality controls for content retrieved by AI tools from external sources.
  • EU AI Act (Article 15): Undermines technical robustness requirements by allowing hidden instructions in processed data.
  • OWASP MCP Top 10 (MCP06:2025 - Prompt Injection via Contextual Payloads): Enables injection of malicious instructions through contextual data retrieved by MCP tools.
Security Indirect prompt injection enables attackers to compromise LLM behavior without direct access to the prompt interface. By embedding malicious instructions in documents, web pages, emails, or database records that MCP tools retrieve, attackers can cause the LLM to leak sensitive data, execute unauthorized commands, ignore safety constraints, or manipulate application logic. This is especially dangerous because the injected content appears to come from legitimate data sources.

​
Explanation

When tools fetch content from external or untrusted sources (files, APIs, web pages), embedded adversarial prompts can manipulate the LLM’s behavior, bypassing user intent and application guardrails.

​
Specifications

Trigger
  • MCP server scan detects tools that fetch or process data from potentially untrusted external sources without proper sanitization or validation
Severity
  • CRITICAL
Applies to: MCP Server