Skip to main content
MCP server causes the LLM to process attacker-controlled context through crafted sampling requests.

​
How to resolve

Limit request frequency and chaining: Implement rate limiting and request count restrictions for tools that interact with LLMs. Monitor for suspicious patterns of rapid or repeated requests. Isolate context between operations: Design tools to maintain clear context boundaries. Avoid allowing incremental context accumulation that could be exploited to build malicious state over multiple requests. Apply aggregate authorization checks: Implement authorization that considers the cumulative effect of chained operations, not just individual requests. Flag or block sequences that escalate privileges. Monitor for context manipulation: Deploy automated detection for unusual context patterns, including gradual instruction injection, privilege escalation sequences, or attempts to persist malicious state across interactions.

​
Risk

Governance/Compliance Sampling vulnerabilities violate multiple security standards:
  • NIST AI RMF (MEASURE-2.7): Fails to monitor AI system behavior for gradual context drift and does not assess capabilities for detecting multi-step manipulation attacks.
  • ISO/IEC 42001 (System Monitoring and Anomaly Detection): Does not implement adequate system monitoring to detect anomalous patterns of incremental sampling requests.
  • EU AI Act (Articles 9, 15): Violates risk management and technical documentation requirements by failing to address cumulative manipulation risks across multiple interactions.
  • OWASP MCP Top 10 (MCP06:2025 - Prompt Injection via Contextual Payloads): Enables injection of malicious instructions through incremental contextual payloads that accumulate over multiple sampling requests.
Security Sampling vulnerabilities enable sophisticated attacks where malicious servers can gradually manipulate the LLM’s context through seemingly innocuous incremental updates. By chaining multiple small requests, attackers can build up malicious context that bypasses single-request guardrails, inject instructions that persist across interactions, or escalate privileges by accumulating authorization through multiple steps. This is particularly dangerous because individual requests may appear benign when examined in isolation.

​
Explanation

Through sampling or crafted requests, an MCP server causes the LLM in the user environment to process attacker-controlled prompts, enabling context manipulation or privilege escalation. This attack exploits tools that issue repeated requests or small-context updates to LLMs, allowing attackers to gradually inject malicious instructions or chain operations into higher-privilege calls.

​
Specifications

Trigger
  • MCP server scan detects patterns where tools issue repeated requests, incremental context updates, or small-batch interactions with LLMs that could chain into higher-privilege operations
Severity
  • HIGH
Applies to: MCP Server