NEW PROMPT INJECTION ATTACK VECTORS THROUGH MCP SAMPLING

Summary from the TLDR InfoSec newsletter

Unit 42 researchers demonstrated three attack vectors exploiting the Model Context Protocol (MCP) sampling feature in AI coding copilots: resource theft through hidden prompts that consume token quotas invisibly, conversation hijacking via persistent prompt injection that alters LLM behavior across sessions, and covert tool invocation enabling unauthorized file system operations without user awareness. The attacks exploit MCP's implicit trust model, where malicious servers can craft prompts requesting LLM completions, with responses processed and hidden from users by the client's summarization layer. Organizations should implement request sanitization with strict templates, enforce capability declarations limiting server permissions, require explicit user approval for tool executions, and deploy statistical analysis to flag abnormal token usage patterns.