New Prompt Injection Attack via Malicious MCP Servers Let Attackers Drain Resources

Security researchers disclosed critical vulnerabilities in the Model Context Protocol (MCP) sampling feature used by LLM-integrated applications, showing how malicious MCP servers can inject hidden instructions into prompts/responses to perform resource theft (unauthorized compute and API credit consumption), conversation hijacking (persistent alteration of assistant behavior), and covert tool invocation (unauthorized file operations and potential data exfiltration). The report attributes the issue to MCP sampling’s implicit trust model and lack of built-in security controls, demonstrates proof-of-concept attacks on a coding copilot, and recommends layered defenses including request sanitization, response filtering, access controls, operation-specific token limits, and explicit approvals for tool execution.