MCP prompt injection exposes a structural trust gap in AI agents

At a glance

What this is: This analysis explains how MCP prompt injection exploits the boundary between retrieved content and executable instructions, making AI agents vulnerable when tool outputs are treated as trusted context.

Why it matters: IAM and security teams need to govern MCP agents as non-human identities with scoped tools, control-plane filtering, and approval gates, because prompt-level defences do not reliably contain injected instructions.

By the numbers:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.

Context

MCP prompt injection is a trust-boundary problem, not just a prompt-quality problem. When an AI agent reads external content through the Model Context Protocol and that content can also steer tool use, the system can no longer assume that retrieved text is inert data.

For identity and access governance, the issue is that MCP turns retrieved content, tool metadata, and execution permissions into one operational path. That creates a governance gap for AI agents that behave as non-human identities, because the model may act on instructions embedded in sources it was never meant to trust.

The article argues that agent-level prompting is insufficient because the attack surface sits in the control plane, the tool boundary, and the server boundary at the same time. That makes the problem typical of emerging MCP deployments, not an edge case.

Key questions

Q: What breaks when MCP prompt injection is not filtered before the agent sees it?

A: The control that breaks is the assumption that retrieved content is inert until a human reviews it. Once hostile instructions reach the model's context, the agent can treat them as task guidance and pass them into tool use. That is why filtering must happen before context ingestion, not after the model has already seen the payload.

Q: Why do MCP agents create more risk than ordinary prompt-based assistants?

A: MCP agents can combine retrieval and execution in the same session, so a single injected instruction can move from content to action without a separate human decision point. That increases the chance of data exfiltration, unintended tool calls, and operational misuse because the model is no longer only generating text.

Q: What are the signs that MCP agent behavior is being manipulated?

A: Common warning signs include repetitive prompt loops, abrupt memory inflation, time inconsistent decisions, unexpected context drift, and access attempts outside the agent's normal route pattern. These signals matter because they often show an attack is moving across prompt, memory, and identity layers. Security teams should alert on deviation from established execution baselines, not only on failed requests.

Q: How should teams balance human confirmation with autonomous tool use in MCP?

A: Use confirmation for actions that can move data, change records, or trigger external side effects, and keep low-risk read operations lightweight. The goal is to make approval a boundary around consequential execution, not a universal slowdown that defeats the usefulness of the agent.

Technical breakdown

How indirect prompt injection enters MCP context

Indirect prompt injection happens when instructions are hidden inside content the agent retrieves from a ticket, document, web page, database record, email, or API response. The model does not distinguish cleanly between content that should be summarised and content that should be executed, so a malicious sentence can survive retrieval and shape downstream behaviour. In MCP, that problem is amplified because the same session often carries both the retrieved text and the tools needed to act on it. The result is not just bad output. It is a path from untrusted content to executable action through the agent's context window.

Practical implication: treat every MCP-retrieved payload as untrusted input until it is filtered before it reaches the model.

Why tool descriptions and server metadata are part of the attack surface

MCP servers do more than return data. They can expose prompts, tool definitions, and runtime permissions, which means hostile instructions can arrive in places that look operationally legitimate. Tool poisoning exploits that trust by hiding guidance in metadata the model may treat as authoritative. In multi-server setups, the risk increases because one client may combine artefacts from several sources and blur boundaries that should stay separate. This is why the issue is architectural. If metadata can instruct the model, then the governance model must assume that server-side declarations can be abused just like user content.

Practical implication: validate tool metadata and server-delivered prompts with the same scepticism you apply to user-supplied text.

Why agent autonomy makes the exposure worse

The more independently an agent retrieves content and invokes tools, the fewer human checkpoints exist between injection and action. That does not mean every AI agent is autonomous in the strict sense, but it does mean the trust failure is operationally faster than manual review can handle. In identity terms, the agent behaves like a non-human identity with delegated execution rights, so least privilege and confirmation controls matter more than prompt wording. The control challenge is therefore not whether the model can be persuaded. It is whether the surrounding identity and execution architecture can stop persuasion from becoming action.

Practical implication: govern MCP agents as scoped non-human identities, not as chat interfaces with a nicer prompt.

Threat narrative

Attacker objective: The attacker wants the agent to convert untrusted content into unauthorized tool use, data disclosure, or harmful operational action.

1. Entry occurs when an attacker places hidden instructions into a support ticket, document, web page, email body, or tool metadata that an MCP-enabled agent later retrieves.
2. Credential or action access follows when the agent loads that content into its context and treats the embedded instructions as if they were legitimate task guidance.
3. Escalation happens when the agent uses its tool permissions to forward data, call external APIs, or perform an unexpected write action that the attacker never directly authenticated.
4. Impact is achieved when the agent exfiltrates data, manipulates records, or triggers an operational action that should have required human review.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Control-plane trust is the real boundary in MCP, not the prompt box. The article shows that retrieved content, tool definitions, and server metadata can all become instruction carriers once they enter the model's working context. That means prompt injection is fundamentally a governance problem about where trust is granted, not a copy-editing problem about better wording. Practitioners should read this as a control-plane design failure, because the attack only works when the system confuses externally sourced text with authorised intent.

Agent memory and retrieval are creating a new form of identity blast radius. Once an MCP agent can read from one source and act through another, the trust boundary no longer sits at a single application edge. That creates a compound identity path in which retrieval, inference, and execution are chained together under one delegated runtime. Practitioners need to treat that chain as one governed surface, because the blast radius expands whenever read permissions and write permissions live in the same agent session.

Least privilege for AI agents must be defined at execution time, not just at provisioning time. The article makes clear that a read-only agent is far less dangerous than one that can send, update, or delete, but the deeper point is that access scope and timing now interact with untrusted context. This is where conventional NHI assumptions begin to fail: if context can steer action, then privilege scope is inseparable from the content the agent consumes. The implication is that IAM and PAM models need to stop treating these as separate layers.

Tool poisoning shows that supply chain trust now extends into agent instructions. A malicious MCP server can hide instructions in descriptions and runtime artefacts that the model receives as part of ordinary operation. That broadens the supply-chain problem from code integrity to instruction integrity, which is a material shift for identity governance. Practitioners should see this as an environment where the trust domain includes server metadata, not just binaries and packages.

Structural trust gap: MCP prompt injection exposes a broken assumption that retrieved content is passive and execution follows only human-authored intent. That assumption was designed for systems where input could be inspected before action, and it fails when the actor is an agent that can interpret, combine, and execute instructions in one session. The implication is that governance has to move from text filtering to runtime boundary control.

From our research library:

• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: MCP Security Guide

What this signals

Prompt injection becomes a governance failure when retrieval and execution share one runtime. Teams should assume that any MCP-enabled agent can be steered by content it reads, especially when that content comes from tickets, repositories, or external web sources. The practical response is to move trust decisions into the control plane and keep execution scopes narrow.

Instruction integrity is now part of the supply chain problem. If a server can ship metadata that the model treats as guidance, then vendor onboarding, tool registration, and proxy policy are identity controls as much as application controls. That means MCP governance has to cover who can publish tools, what those tools may say, and which actions they can trigger.

Agents with more scope create more attack surface than their prompts reveal. According to the 2026 Infrastructure Identity Survey, 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job. That access gap matters here because injected content only becomes dangerous when the agent is allowed to act on it.

For practitioners

• Implement control-plane filtering Scan tool responses, metadata, and retrieved content before they enter the model context, and block imperatives, hidden instructions, and outbound-data directives at the gateway.
• Scope agent tools tightly Limit each agent to the smallest tool set required for its task, and remove write, send, and external-call permissions unless the workflow explicitly needs them.
• Require human confirmation for risky actions Gate external sharing, deletions, purchases, and other irreversible tool calls with explicit approval that is separate from the model's own instructions.
• Log and review tool usage continuously Record every MCP tool call, then hunt for repeated calls, unexpected destinations, and actions that do not match the agent's declared purpose.
• Treat server metadata as governed input Review tool descriptions, prompt templates, and runtime permissions as part of security review, because a malicious server can embed guidance where the model expects trusted instruction.

Key takeaways

• MCP prompt injection works because the model can treat retrieved content, metadata, and tool outputs as instructions rather than data.
• The risk is highest when agents can both read untrusted sources and execute tool actions in the same runtime.
• Control-plane filtering, narrow tool scopes, and human confirmation for risky actions are the controls that reduce the blast radius.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Control plane filtering: A central enforcement layer that inspects tool outputs before they reach an agent or model. It can redact, mask, or block sensitive values so that the workflow continues while the data exposure is reduced to the minimum necessary level.
• Tool Poisoning: Tool poisoning is an attack in which malicious instructions are hidden inside tool descriptions, examples, or schemas that an AI agent reads when deciding what to do. The danger is not only in the tool's code, but in the metadata that shapes the agent's behaviour and trust decisions.
• Agent Blast Radius: Agent blast radius is the amount of damage an AI agent can cause if it is compromised, misconfigured, or behaves unexpectedly. It includes the systems, data, identities, and actions the agent can reach through its permissions, tool access, and network paths, and is reduced by least privilege, segmentation, and strong controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.