Malicious MCP Servers Enable Stealthy Prompt Injection to Drain System Resources
Security researchers have identified critical vulnerabilities in the Model Context Protocol (MCP) sampling feature, which allow malicious servers to execute prompt injection attacks, consume computational resources, and compromise large language model…
Security researchers have identified critical vulnerabilities in the Model Context Protocol (MCP) sampling feature, which allow malicious servers to execute prompt injection attacks, consume computational resources, and compromise large language model (LLM) applications without user detection.
Three Critical Attack Vectors Identified
The study highlights three main attack vectors exploiting the protocol's trust model and lack of security controls. Researchers used a coding copilot application that integrates MCP for code assistance to demonstrate proof-of-concept attacks.
The experiments showed that malicious servers could exploit the sampling feature through resource theft, conversation hijacking, and covert tool invocation.
Resource Theft: Malicious servers append hidden instructions to legitimate prompts, causing the LLM to generate additional content unseen by users. This consumes computational resources and API credits unauthorizedly. Conversation Hijacking: By injecting instructions into LLM responses, malicious servers can alter the AI assistant's behavior. This could lead to unreliable or dangerous interactions. Covert Tool Invocation: Malicious servers can trigger unauthorized system operations, such as file writing, enabling data exfiltration and unauthorized system changes.
The study highlights three main attack vectors exploiting the protocol's trust model and lack of security controls.
The research underscores that MCP sampling relies on an implicit trust model without built-in security controls, which creates attack opportunities. The disconnect between user-visible and LLM-processed content facilitates resource exhaustion attacks and hidden malicious activities.
Various MCP implementations may handle output filtering differently, with some potentially showing complete LLM responses, while others may obscure hidden content with summarization layers.
Palo Alto Networks recommends implementing comprehensive security measures to protect AI systems from these threats. This includes enhanced validation of sampling requests, monitoring for anomalous token consumption patterns, and implementing safeguards against persistent prompt injection.
As MCP adoption grows, understanding and mitigating these attack vectors is essential for maintaining the integrity and security of LLM-powered tools and services.
Based on reporting by GBHackers.