Prompt injection during the MCP connection phase and cache poisoning across callers

Researcher Mike Moore reproduced prompt injection during the MCP connection phase in his self-built experimental environment mcp-redteam-lab: the client folds the instructions field returned by the server in initialize and server/discover into the model's system prompt, and this field is entirely server-controlled with no length limit and no content validation. A read-only scan of the official registry shows that 5,462 of 8,235 online servers (66%) return this field, with a median length of 577 characters and a maximum of 68,669 characters. When a response is found to carry cacheScope: public, a shared cache or gateway re-serves one caller's response to another caller, and the latter receives the injected text even though it never connected to the malicious server. In the experiments, the author gives four controls: isolate and mark as untrusted, limit to 4,096 characters, bind cache keys to server identity and caller, and do fixed validation on a summary of instructions, and notes that these controls only prevent the text from being accepted, not from being sent.

The CSA research brief relays Tenet Security's agentjacking research disclosed in June 2026: untrusted monitoring events entering a coding agent via MCP tools may be mistaken for trusted instructions. Tenet self-reports an 85% success rate in controlled tests and claims to have found exposure conditions in 2,388 organizations; these are the researchers' reports, the number of exposures does not equal the number of confirmed victims, and there is no independent reproduction yet.