New Prompt Injection Attack Vectors Through MCP Sampling

According to Unit 42, the article examines security implications of the Model Context Protocol (MCP) sampling feature within a widely used coding copilot, showing that, without safeguards, malicious MCP servers can exploit sampling for a range of attacks. It identifies three critical attack vectors: resource theft through draining AI compute quotas, conversation hijacking via persistent instructions that survive turns, and covert tool invocation enabling hidden operations such as file writes without user awareness.

The piece describes PoC experiments that involve a malicious MCP server and a code summariser tool, demonstrating how hidden prompts can trigger extra content generation, persistent prompt injection, and unauthorized tool use. It also outlines detection and prevention strategies, including request and response scanning for injection patterns, template-based sanitisation, and access controls to limit server capabilities.

Palo Alto Networks promotes protective options such as Prisma AIRS and the Unit 42 AI Security Assessment, and provides contact details for the Unit 42 Incident Response team for urgent matters. Published on 5 December 2025, the article highlights the need for layered defence to safeguard MCP-based systems.