MCP Servers face prompt injection

Short summary

MCP servers create real prompt injection vulnerabilities when untrusted data from external sources (GitHub issues, emails, web pages) flows into an agent's context alongside write-capable tools. Key mitigations: apply least-privilege token scopes, isolate untrusted reads from write tools, vet community servers before install, keep secrets out of the model's context, and confirm critical actions with human checkpoints.

• •MCP turns prompt injection from a chatbot trick into an actual security problem because agents control real systems
• •Threat vectors: untrusted external data entering agent context, overly-broad token scopes, and unvetted community server installation
• •Defenses: least-privilege tokens per task, separate read/write sessions, source verification, secret isolation, and human approval gates

Generated with AI, which can make mistakes.