Unverified50% confidenceEventExact time
Invariant Labs demonstrated a tool poisoning attack: hidden instructions in the tool description of a "daily fun fact" MCP server manipulated the model into extracting WhatsApp history and sending it to the attacker.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/22/2026
First Seen
Valid until: 1/20/2027
Sources
Related Entities
Related Claims
UnverifiedIn April 2025, Invariant Labs conducted a proof-of-concept experiment demonstrating a complete attack chain that steals users' chat records through hidden instructions in a malicious MCP server.76% similarVerifiedA malicious MCP Server can declare a legitimate tool name and embed prompt injection instructions in the description field; this type of attack is known as "Tool Poisoning."74% similarUnverified恶意指令抵达模型有两条路径：一是工具描述本身（工具投毒），二是服务器实现代码中的行为（如postmark-mcp的BCC隐藏在邮件API实现里）。71% similarUnverifiedPrompt injection is a security vulnerability unique to LLM applications, where attackers can embed malicious instructions in tool results returned by an MCP server to manipulate agent behavior.70% similarUnverifiedAttackers can embed hidden instructions in MCP tool description fields (such as HTML comments, zero-width characters, or words written directly to the model); these instructions execute in the Agent's reasoning loop, and traditional firewalls, WAFs, and input filtering all fail at this location.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1085483API
curl https://kongchang.com/api/v1/knowledge/claims/1085483MCP
get_claim(id=1085483)