Tenable Research Reveals Dual Nature of MCP Prompt Injection: A Tool for Both Attack and Defense

MCP: A Double-Edged Sword in AI Security

The Model Context Protocol (MCP), launched by Anthropic in November 2024, has emerged as a pivotal framework in the AI landscape, enabling Large Language Models (LLMs) to interface with external data sources and services. However, recent research by Tenable has uncovered that MCP's susceptibility to prompt injection attacks can be leveraged not only for malicious purposes but also for enhancing security measures 1

1

Understanding MCP and Its Vulnerabilities

MCP follows a client-server architecture, allowing hosts with MCP clients to communicate with various MCP servers, each offering specific tools and capabilities. While this open standard provides a unified interface for accessing diverse data sources, it also introduces new risks, including excessive permission scope and indirect prompt injection attacks 1

1

Repurposing Prompt Injection for Security

Tenable's research demonstrates how MCP's tool descriptions, typically used to guide AI behavior, can be crafted to enforce execution sequences and insert logging routines automatically. By embedding priority instructions into a logging tool's description, researchers were able to prompt some LLMs to run it first before executing any other MCP tools, capturing details about the server, tool, and user prompt that initiated the call 2

2

Cross-Model Behavior and Security Implications

The experiments revealed variations in how different LLMs respond to embedded instructions:

1. Claude Sonnet 3.7 and Gemini 2.5 Pro showed consistency in following the enforced order and exposed slices of the system prompt 4

   4

   .
2. GPT-4o inserted the logger but produced inconsistent, sometimes hallucinated parameter values 2

   2

   .

Related Stories

Anthropic's Model Context Protocol has critical flaw exposing 200,000 servers to remote takeover

Prompt injection attacks hit over 90 firms in 2025 as AI security risks escalate

OpenAI admits prompt injection attacks on AI agents may never be fully solved

AI Agents Hijacked via Prompt Injection: Bug Bounties Paid, Security Advisories Withheld

Defensive Applications of MCP Manipulation

Tenable's research highlights several defensive applications of MCP manipulation:

1. Creating a tool to function as a policy firewall, blocking specific MCP tools by name 2

   2

   .
2. Developing introspection tools to identify other MCP tools configured to run first, potentially valuable for threat detection or reverse-engineering tool configurations 2

   2

   .
3. Attempting to extract the system prompt used by the LLM itself, providing insight into how the AI interprets its operational environment 2

   2

   .

Implications for AI Security and Development

As organizations increasingly deploy autonomous agents to handle sensitive workflows, understanding how these systems interpret and act on tool instructions becomes critical. The research underscores both the flexibility and fragility of agentic AI systems built on MCP 2

2

Ben Smith, senior staff research engineer at Tenable, emphasizes the importance of treating MCP servers as an extension of the attack surface, urging caution in their implementation and use 3

3