Model Context Protocol has prompt injection security problems

simonwillison.net

6 points·simonw··8 comments

The Tool Poisoning attack seems like any other example of installing software you didn’t write yourself. There could be malicious instructions in any program.

That's why I added the section pointing out that even without installing a malicious server you may run into problems with malicious instructions: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/#m...

I am curious how is your example add function that allows an LLM to read files or environment variables and send the stolen data to another server is different from data exfiltration supply chain attack? To me it looks like that this type of attack isn't inherent to LLM-based applications.

We recently updated our post on WhatsApp tool poisoning, to include an attack setup that does not require a malicious MCP server.

It suffices to send you an injected message.

See: https://invariantlabs.ai/blog/whatsapp-mcp-exploited#experim...

I tried to come up with an optimistic response, but when you consider all the ways data can be exfiltrated: if you can send a bit, you can send a file.

So what is it with MCP? It’s just the latest hype-infused hysteria of the architecture astronauts. And please, “don’t let architecture astronauts scare you.” https://www.lycee.ai/blog/why-mcp-is-mostly-bullshit

I think part of it is that many people hadn't yet cottoned on to how powerful the LLM+tools pattern has got.

A lot of the MCP buzz is more "wow, you can give an LLM access to custom tools and it can take actions on your behalf!" - if MCP is the first time you've truly understood that, I can see why you'd be very excited about it.

MCP is basically what RAG was 2 years ago.

Reply on news.ycombinator.com