Threat Library

Researchers demonstrate a novel attack (ISM) that manipulates which skill/tool an LLM agent selects by crafting benign-looking skill metadata and prompts whose semantic relationship is engineered to bias the selector, without any explicit steering instructions. This bypasses human review and existing prompt-injection defenses far more effectively than explicit instruction-based attacks, raising the target-selection rate from ~15% baseline to ~63-73%.

This is an academic research paper (not an active exploit) describing 'TrustShift', a class of attacks where a malicious MCP tool server behaves benignly during an initial conditioning period to build trust, then switches to adversarial behavior once agents rely on it heavily. The researchers built an attack taxonomy and a benchmark showing ~69.5% attack success rate against frontier agents, plus a runtime defense (SHIELD) that reduces this to ~42.7%.

A vulnerability in the Apify MCP server allowed a malicious Actor publisher to craft a URL that redirected the MCP client to an attacker-controlled server while the victim's Apify API bearer token was still attached to the request. Simply invoking or inspecting the malicious Actor via the MCP tool-loading paths caused the victim's credentials to be exfiltrated to a third-party host. This is a classic MCP tool-poisoning/SSRF hybrid where untrusted actor metadata influences a trusted connection's destination.

MCP Appium, an MCP server for automating mobile app testing, fails to sanitize attacker-controlled UI element attributes before embedding them in an HTML template returned by its generate_locators tool. A malicious mobile app under test can inject HTML/JavaScript that executes in the MCP client's rendering context and calls arbitrary MCP tools via postMessage, effectively letting the app-under-test hijack the testing agent's capabilities.

Researchers demonstrate a structural flaw in the Model Context Protocol: the metadata a human approves in a tool-installation dialog is not guaranteed to match the bytes actually sent to the model. Using invisible Unicode TAG-block characters embedded in tool descriptions, an attacker can smuggle hidden instructions that a human reviewer never sees but that reach the LLM verbatim on every turn, and this was confirmed across three independent MCP server implementations. This is a research proof-of-concept, not an observed active exploit, but it identifies a reproducible, protocol-level weakness rather than a one-off bug.

Researchers demonstrate ShareLock, a proof-of-concept attack that hides a malicious instruction by splitting it into innocuous-looking secret shares distributed across multiple MCP tool descriptions using Shamir's threshold scheme. When triggered by a covert reconstruction event (planted during a server update), the shares recombine into a working malicious prompt, achieving over 90% attack success while evading current tool-description auditing. This is a disclosed research finding, not an observed in-the-wild exploit, but it demonstrates a realistic and highly evasive supply-chain vector against MCP-based agent ecosystems.

Malicious or compromised MCP servers embed hidden instructions in tool metadata that the model reads but the human approving the tool never sees, steering agents into data exfiltration or unauthorized actions. First documented publicly by Invariant Labs in 2025 and since reproduced across many clients.