Line jumping is a pre-invocation attack in which a malicious MCP server inserts instructions that influence the model before any normal tool call occurs. The server bypasses the expected user-driven flow and can trigger hidden actions, including data exfiltration or prompt manipulation, without an explicit invocation that appears suspicious to the user.
Expanded Definition
Line jumping describes a pre-invocation attack pattern in which a malicious Model Context Protocol server injects instructions before the expected tool-use sequence begins. In practice, the server is not simply returning hostile content after a call; it is altering the model’s behaviour at the earliest possible stage, often before the user sees any obvious sign that a tool interaction has started. That makes it especially relevant to agentic systems where tool routing, message ordering, and trust boundaries are weakly enforced.
In NHI and agent security terms, line jumping matters because it exploits the authority granted to infrastructure, not just the prompt content itself. The attacker uses the server relationship to influence execution, steer tool selection, or hide exfiltration logic inside what appears to be normal integration traffic. Definitions vary across vendors, and no single standard governs this yet, but the operational meaning is consistent: the model is being manipulated before the user-driven invocation flow should begin. For broader NHI governance context, Ultimate Guide to NHIs helps explain why service-side trust and credential exposure are central to this class of risk. The most common misapplication is treating line jumping as a prompt-injection issue only, which occurs when teams ignore the pre-invocation trust path and focus only on model output filtering.
Examples and Use Cases
Implementing protections against line jumping rigorously often introduces latency and integration friction, requiring organisations to weigh tighter pre-execution validation against faster agent responses.
- A remote MCP server prepends hidden instructions that cause the agent to call a sensitive internal tool before the user request is fully processed.
- A compromised integration modifies handshake metadata so the model receives attacker-controlled routing cues during session setup.
- An agentic workflow accepts server-supplied context without strict allowlisting, enabling the server to influence downstream retrieval or action selection.
- A third-party MCP endpoint uses subtle instruction framing to shift the model away from approved policy checks and toward an exfiltration path.
The attack surface is easier to understand when compared with established identity and control guidance in the NIST Cybersecurity Framework 2.0. For NHI-specific operational patterns, the Ultimate Guide to NHIs is a useful reference for how weak service-account governance can amplify hidden execution paths.
Why It Matters in NHI Security
Line jumping is dangerous because it turns a trusted non-human component into an unreviewed control point. Once a malicious server can speak first, it can shape the model’s interpretation of the session, conceal policy violations, and route the agent toward data disclosure or unauthorized actions without an overtly suspicious user-facing step. That makes incident detection much harder than with ordinary prompt attacks, because the harmful instruction may arrive before logging, filtering, or policy enforcement is fully engaged.
NHI governance becomes central here because the server itself functions like an identity-bearing actor with influence over execution. NHIMG reports that only 5.7% of organisations have full visibility into their service accounts, which helps explain why pre-invocation compromise can stay hidden for long periods; the same guide also notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys in the Ultimate Guide to NHIs. In practical terms, defenders need provenance checks, strict tool trust boundaries, and explicit server validation, not just content moderation. Organisations typically encounter the operational impact only after an agent has already leaked data or executed an unexpected tool call, at which point line jumping becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | AA3 | Pre-invocation instruction injection maps to agentic prompt and tool abuse risks. |
| OWASP Non-Human Identity Top 10 | NHI-05 | Malicious MCP servers exploit trust and access paths tied to non-human identities. |
| NIST CSF 2.0 | PR.AC-3 | Least-privilege and authorized access concepts apply to server-driven model interactions. |
| NIST Zero Trust (SP 800-207) | Zero Trust requires explicit verification of every component, including tool servers. | |
| NIST AI RMF | This is an AI system manipulation risk that affects governance, measurement, and monitoring. |
Validate every tool-context input path before execution and treat server-supplied instructions as untrusted.
Related resources from NHI Mgmt Group
- How do IAM teams adjust governance when developers supervise agents instead of writing every line themselves?
- Why does a cheap front-line model change IAM risk for AI systems?
- Who should be first in line for phishing-resistant authentication?
- How should teams govern browser-based login for a command-line tool?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
