Prompt injection in tool metadata

prompt-injection · Tools — listing

Endpoint (Streamable HTTP)

https://chaos-mcp.thomascdnns.com/s/prompt-injection/mcp

On the wire — recorded from a real request

Symptom

what you'll observe

The model's behaviour changes after listing/calling the tool — it follows hidden instructions.

Cause

what this reproduces

Untrusted tool descriptions/results contain instructions aimed at the host model.

Fix

how you'd resolve it

Treat tool metadata as untrusted data; sandbox/marker untrusted content; don't let it steer the agent.

Try it with curl

bash

curl -sS -X POST \
  https://chaos-mcp.thomascdnns.com/s/prompt-injection/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1"}
    }
  }'