Topic starter
16/01/2026 1:59 pm
TL;DR: Invisible Unicode characters can alter MCP tool descriptions in ways humans miss but AI agents may still process, creating hidden instruction paths and unwanted tool execution, according to Noma Security. The risk shifts MCP governance from simple trust in visible metadata to integrity checks, privilege boundaries, and continuous monitoring.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Invisible risk: unicode exploits in mcp and the ai supply chain”.
Key questions
Q: What breaks when invisible characters are allowed in MCP tool descriptions?
A: Human review stops being a reliable control because the visible text and the machine-read text no longer match.
Q: Why do hidden instructions in MCP tools create security risk?
A: Because the model may treat tool descriptions as actionable context, not passive documentation.
Q: How can security teams detect malicious MCP tool metadata?
A: They should normalise Unicode, reject non-printing characters, and inspect tool registration content before it enters the agent runtime.
Practitioner guidance
- Scan MCP tool descriptions for invisible characters Normalise Unicode in every registered tool description, function summary, and prompt fragment before it reaches an agent runtime.
- Validate tool provenance before agent use Require origin checks and signed or otherwise attested tool metadata so the agent only consumes descriptions from trusted publishers and build paths.
- Constrain agent actions to approved tool scopes Map each agent to the smallest viable action set and block follow-on execution that is not required for the task.
Bottom line: Invisible characters can turn benign-looking MCP metadata into hidden instructions that an AI system may still act on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:34 pm
Invisible tool text creates a governance gap, not just a content-safety bug. The core issue is that humans review one version of the tool description while the model may process another. That breaks the assumption that visible metadata is the same thing as executable intent. For identity teams, the implication is that tool descriptions themselves need governance as security-bearing artefacts, not comments.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations govern AI agent access to repositories and MCP servers?
A: Treat those connections as governed identity pathways, not casual tooling integrations. Define which identities may authenticate, record every session context, and review the downstream tools an agent can reach so repository access, API use, and MCP activity remain attributable and bounded.
👉 Read our full editorial: Invisible MCP payloads expose a new AI supply chain risk