MCP Tool Description Instruction Hijack
Published: 2026-01-15
Updated: 2026-05-01
Malicious MCP server encodes imperative instructions inside tool description fields. When an LLM reads the tools/list, the instructions execute as if issued by the operator, enabling data exfiltration or lateral movement.
Indicators of Compromise
- Tool description contains imperative instructions (ignore, disregard, before returning…)
- Base64-encoded content embedded in tool description
- Redirect instructions to external URL in description
- Hidden unicode characters (zero-width, bidi-override) masking instructions
npm MCP Package Typosquatting Attack
Published: 2026-02-03
Updated: 2026-04-20
Attackers register npm packages with names 1–2 characters different from canonical MCP packages (e.g., @modelcontextprot0col/server-filesystem). The package installs a backdoor that exfiltrates tool call arguments.
Indicators of Compromise
- Package name within Levenshtein distance 2 of trusted MCP package
- Maintainer account created within 7 days of package publish
- Single maintainer with generated or numeric username
Indirect Prompt Injection via Retrieved Documents
Published: 2026-01-28
Updated: 2026-05-10
Content retrieved from external sources (web search, RAG, email) contains embedded instructions that the LLM executes when processing the retrieved context, bypassing system-prompt restrictions.
Indicators of Compromise
- Instruction syntax embedded in retrieved document (HTML comments, markdown)
- Hidden unicode characters masking instructions in retrieved content
- "Note to AI/LLM:" prefix in externally retrieved text
AI Agent Memory Poisoning via Tool Results
Published: 2026-03-11
Updated: 2026-05-13
A compromised tool returns results containing instructions to modify the agent's stored memory or context, causing the agent to misclassify future requests or grant unauthorized permissions.
Indicators of Compromise
- Tool result contains system-prompt-like instructions
- Tool result claims to update agent permissions or grants
- Embedded credential claims in tool return value
LLM-Generated Reverse Shell via Code Execution Tool
Published: 2026-02-20
Updated: 2026-05-14
The LLM is manipulated (via prompt injection or jailbreak) into generating a reverse shell payload that is then executed through an attached code-execution tool, giving the attacker persistent shell access.
Indicators of Compromise
- Reverse shell pattern in LLM output (bash -i >& /dev/tcp, nc -e)
- Base64-encoded shell command in generated code
- C2 callback URL in LLM-generated script
Autonomous Agent Credential Exfiltration
Published: 2026-03-05
Updated: 2026-05-14
An autonomous agent tasked with file or environment access is manipulated into reading credential files (AWS credentials, .env, SSH keys) and exfiltrating them via an outbound HTTP call disguised as a legitimate API request.
Indicators of Compromise
- Read of ~/.aws/credentials, .env, or ~/.ssh/id_rsa
- Outbound POST immediately following credential file read
- Environment variable enumeration followed by HTTP call
Multi-Agent Chain Prompt Injection
Published: 2026-04-02
Updated: 2026-05-13
In a multi-agent pipeline, a compromised downstream agent returns a response that contains injected instructions targeted at the upstream orchestrator, causing the orchestrator to take unauthorized actions.
Indicators of Compromise
- Agent response contains system-prompt-like [SYSTEM] prefix
- Response claims to be from a higher-privilege agent
- Downstream response requests orchestrator to take out-of-scope actions
AI-Generated Spear Phishing via Email Agent
Published: 2026-04-18
Updated: 2026-05-10
An AI agent with email-send capability is manipulated via prompt injection to compose and send highly personalized spear-phishing emails to contacts in the user's address book, impersonating the user.
Indicators of Compromise
- Email send action with non-user-authorized recipient
- Credential harvesting link in composed email body
- Bulk send to all contacts or address book
MCP Server Process Sandbox Escape
Published: 2026-04-25
Updated: 2026-05-14
A malicious MCP server uses tool calls to probe for sandbox misconfiguration, then exploits filesystem or network access that should be restricted, escaping the intended execution boundary.
Indicators of Compromise
- MCP tool call to read /proc, /sys, or /etc (outside declared scope)
- Attempt to access paths outside declared tool scope
- Network call to undeclared external host from sandboxed process
Synthetic Maintainer Identity Package Takeover
Published: 2026-05-01
Updated: 2026-05-14
Attackers use AI-generated identities (synthetic GitHub profiles, bulk-registered npm accounts) to register look-alike packages or take over abandoned packages with expired maintainer emails.
Indicators of Compromise
- Maintainer username matches AI-generated pattern (user12345678, hex strings)
- Package ownership transfer within 30 days of re-registration
- Single maintainer on a previously multi-maintainer package
No advisories match your search.