Notifications
Clear all
Topic starter
18/08/2026 2:24 pm
TL;DR: MCP prompt injection lands inside tool descriptions during server registration, letting attackers steer agents into legitimate tools they already approved, and MCPTox found 72.8% attack success across 45 live servers and 1,312 cases according to ARMO. The result is a governance problem for approved toolchains, because inspection and allowlists miss coercion that only appears after the agent reads its tool list.
NHIMG editorial — based on content published by ARMO: MCP prompt injection and the tools you approved
By the numbers:
- The average attack success rate across every configuration was 36.5%.
Questions worth separating out
Q: What breaks when MCP tool descriptions can be modified by an attacker?
A: The trust boundary breaks.
Q: Why do approved tools create risk in MCP environments?
A: Approved tools are risky because the malicious instruction does not need to invoke an untrusted tool.
Q: How should security teams protect MCP tools from hidden prompt injection?
A: Treat MCP tool metadata as untrusted input.
Practitioner guidance
- Separate metadata trust from tool execution trust Validate MCP tool descriptions at registration and on change, then compare them against an approved baseline before the agent loads them into context.
- Baseline agent-specific tool behaviour Record the normal tools, parameter values, call order, and downstream file or network effects for each production agent so deviations stand out immediately.
- Flag cross-server tool influence Review cases where a description from one server changes how the agent uses a tool from another server, because that is the pattern the approval layer will not see.
What's in the full article
ARMO's full blog covers the operational detail this post intentionally leaves for the source:
- Benchmark methodology across 45 live MCP servers and 20 agent configurations, including how the attack success rate was measured.
- Examples of poisoned tool-description payloads and how they were structured to trigger legitimate downstream tool calls.
- Discussion of agent behaviour under reasoning mode, including why more capable models were more susceptible in this test.
- Practical detection ideas for runtime teams that want to compare tool-call history against a per-agent baseline.
👉 Read ARMO's analysis of MCP prompt injection and compromised NHIs →
MCP prompt injection: are approved tools now the attack surface?
Explore further
18/08/2026 3:15 pm
Tool metadata is now part of the identity attack surface: MCP turns registration-time descriptions into an input that can override planning, which means the trust boundary sits earlier than most teams model it. The governance lesson is that allowlisting a server does not mean trusting every capability statement it publishes. IAM and NHI teams should treat descriptions as policy-bearing material, not harmless documentation.
A few things that frame the scale:
- Attack success reached 72.8% across 45 live MCP servers, 353 authentic tools, 1,312 malicious test cases, and 20 agent configurations, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Another finding from the same research showed that when AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, with some attempts arriving in as little as 9 minutes.
A question worth separating out:
Q: What should organisations do when agent tool calls stay valid but look unusual?
A: Treat them as potential compromise, not as benign variance. Start by validating whether the call matches the agent’s historical pattern for that task, then review the source server, the tool description history, and any cross-server influence. If the request is valid but contextually abnormal, contain the agent before it completes additional delegated actions.
👉 Read our full editorial: MCP prompt injection shows how approved tools can be turned against agents
