A prompt injection attack delivered through content an AI agent retrieves via the Model Context Protocol. The model reads hostile text as if it were part of the task, which can redirect tool use, data access, or other downstream actions if controls are weak.
Expanded Definition
MCP prompt injection is a supply-chain style instruction attack in which hostile content is retrieved through the Model Context Protocol and then treated by an AI agent as if it were trustworthy task input. The weakness is not the protocol itself, but the absence of strong separation between retrieved context and executable instructions. In practice, the model may follow malicious text embedded in documents, tickets, chat messages, or tool responses and then carry those instructions into downstream actions.
Definitions vary across vendors on whether this is a distinct MCP-specific category or a broader agentic prompt injection pattern that happens to travel over MCP. NHI Management Group treats it as an operational risk whenever MCP-connected agents consume untrusted context without policy enforcement, content isolation, or permission-bound tool execution. That makes it closely related to guidance in the OWASP Agentic AI Top 10, even though no single standard governs this yet.
The most common misapplication is assuming retrieval from a known MCP server makes the content safe, which occurs when teams trust source identity but fail to validate the instructions inside the retrieved payload.
Examples and Use Cases
Implementing MCP rigorously often introduces extra filtering, approval, and content-sanitisation overhead, requiring organisations to weigh agent autonomy against control-plane friction.
- An internal knowledge server returns a meeting note that includes hidden instructions to export customer records, and the agent follows them because the note is treated as task context.
- A ticketing integration delivers a malicious comment that tells the agent to ignore prior policy and invoke a privileged tool, similar to patterns discussed in the Gemini AI Breach — Google Calendar Prompt Injection.
- A code assistant retrieves repository instructions through MCP and is nudged to overwrite files or run unsafe commands, a risk area also analysed in Analysis of Claude Code Security.
- An external data source embeds a prompt that instructs the agent to forward secrets into a chat channel, which can resemble the behaviour seen in the Amazon Q AI Coding Agent Compromised case.
- A product research agent uses MCP to summarise vendor pages, but malicious page content steers the agent toward incorrect recommendations or unwanted tool calls.
The OWASP OWASP Top 10 for Agentic Applications 2026 frames this as a prompt-injection and tool-abuse problem, especially where retrieved content can influence the agent’s decision path.
Why It Matters in NHI Security
MCP prompt injection matters because it turns a content problem into an identity and authority problem. Once an agent accepts hostile instructions, the blast radius depends on the permissions attached to its NHI, its tool access, and whether secret handling is segregated from retrieval. That is why this issue is inseparable from least privilege, scoped tool use, and strong execution boundaries. NHI Management Group research shows that 80% of organisations report AI agents have already performed actions beyond their intended scope, including unauthorised system access, sensitive data sharing, and revealing credentials, which is exactly the kind of downstream harm prompt injection can trigger when controls are weak. The same research shows only 52% can track and audit the data their AI agents access, leaving a large blind spot for incident response and compliance.
This risk is especially serious in MCP environments because a compromised prompt can become a path to credential exposure, data exfiltration, or destructive tool invocation without any traditional malware being present. It also aligns with the agentic threat patterns highlighted in the OWASP Agentic Applications Top 10. Organisations typically encounter the damage only after an agent has already executed an unsafe action, at which point MCP prompt injection becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A3 | Prompt injection and tool abuse are core agentic application risks. |
| OWASP Non-Human Identity Top 10 | NHI-06 | MCP prompt injection becomes dangerous when NHI permissions are overly broad. |
| NIST CSF 2.0 | PR.AC-3 | Access enforcement must limit what agents can do after malicious context is read. |
| NIST Zero Trust (SP 800-207) | SC-3 | Zero trust requires continuous verification of agent decisions and tool requests. |
| NIST AI RMF | GV.3 | AI governance must address misuse, manipulation, and unsafe downstream behaviour. |
Isolate untrusted context, restrict tool authority, and validate agent actions before execution.
