Researchers reproduce prompt injection and cross-caller cache poisoning during the MCP connection phase

Researcher Mike Moore reproduced prompt injection during the MCP connection phase in his self-built experimental environment mcp-redteam-lab: the client folds the instructions field returned by the server in initialize and server/discover into the model's system prompt, and this field is entirely server-controlled with no length limit and no content validation. A read-only scan of the official registry shows that 5,462 of 8,235 online servers (66%) return this field, with a median length of 577 characters and a maximum of 68,669 characters. When a response is found to carry cacheScope: public, a shared cache or gateway re-serves one caller's response to another caller, and the latter receives the injected text even though it never connected to the malicious server. In the experiments, the author gives four controls: isolate and mark as untrusted, limit to 4,096 characters, bind cache keys to server identity and caller, and do fixed validation on a summary of instructions, and notes that these controls only prevent the text from being accepted, not from being sent.