Prompt Injection, Tool Poisoning, and Dynamic Tool Changes

MCP enables powerful actions, but it also introduces threats that arise from the way models interpret external context and tool metadata.

Indirect prompt injection occurs when malicious instructions are hidden inside external content such as an email, web page, or PDF. The model reads the content as part of the user's task but may also follow the hidden instructions. The result can be unintended actions, data leakage, privacy breaches, or harmful output.

Tool poisoning occurs when the metadata of an MCP tool is altered. Models use tool names, descriptions, and parameters to decide which tools to call. Malicious metadata can therefore influence the model to select or use a tool in an unsafe way.

Dynamic tool modification creates another risk. A hosted tool can be changed after the user has approved it. The user may believe they approved one capability while the server later presents different metadata or behavior. This type of change is described as a rug-pull attack.

Prompt Shields are presented as a defence against direct and indirect prompt injection. The described protections include detection and filtering of malicious content, spotlighting to help the model distinguish system instructions from external text, and delimiters or data marking that identify trusted and untrusted content. Prompt Shields also integrate with Azure AI Content Safety and receive continuing updates.

These protections work alongside permissions and tool controls. Sensitive actions should remain subject to user approval, and the server should not receive more access than it needs.