An MCP server can return apparently ordinary tool results or descriptions that ask a coding agent to take further actions. MCPVenom tested whether agents promote such lower-trust material into authority. Its controlled matrix crossed 12 frameworks, 18 models and 45 scenarios, giving 9,720 designed cells rather than 9,720 completed binary trials. Study. The…
Inspect the ClaimsCase · DiggingBeagle record
MCPVenom found model-tool trust failures across MCP clients
In 9,720 test cells, 2,113 outcomes were vulnerable and 255 verified canary exfiltrations; these are different denominators and outcomes.
Indirect prompt injectionMCP tool catalog restrictions can diverge from invocation authorizationLive authorization at the point of agent side effectEffect-bound approval
Public disclosure: Nov 3, 2026
Scope
Research evaluation across specified agent frameworks, models and fixtures, not a measurement of live ecosystem compromise.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The controlled cross-framework matrix uses separate intent and network oracles and hand-reviewed sampled traces. The canary receipt distinguishes completed synthetic exfiltration from merely proposed actions. It does not prove real secret theft or establish the prevalence of unsafe deployment configurations. Task-bound tool permission and network egress restrictions are plausible controls, not independently validated universal countermeasures here.. Impact is ungraded because no independently measured production-target impact or victim scope is established by this record.
Assessed Nov 4, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-NOV04-MCPVENOM-TOOL-OUTPUT-1 · CLM-NOV04-MCPVENOM-TOOL-OUTPUT-2 · CLM-NOV04-MCPVENOM-TOOL-OUTPUT-3 · MCPVenom: benchmark of tool-output prompt injection in MCP agent frameworks
At a glance
MCP security requires typed trust provenance on results and enforcement of task-specific tool capabilities before side effects; treating model refusal as the only line of defense is insufficient.
Read the implicationsThe 255 canary events do not establish real-world victim losses or deployment prevalence. The tested framework/model matrix does not establish behavior for all versions or configurations.
Limits and uncertaintyFull account
An MCP server can return apparently ordinary tool results or descriptions that ask a coding agent to take further actions. MCPVenom tested whether agents promote such lower-trust material into authority. Its controlled matrix crossed 12 frameworks, 18 models and 45 scenarios, giving 9,720 designed cells rather than 9,720 completed binary trials. Study.
The authors classified 2,113 cells as vulnerable and 7,102 as resistant, with another 237 errors and 268 skipped. Their reported 22.9% susceptibility is therefore 2,113 divided by 9,215 valid vulnerable-or-resistant cells. The 505 errors and skips are neither successful exploits nor proof of resistance. A live attack rate cannot be inferred from this benchmark denominator.
More importantly, the vulnerable outcomes have three different evidence levels: 1,371 dispatched attacker-directed tool calls, 487 confirmed contacts with the attacker endpoint, and 255 verified synthetic-secret exfiltrations. Only that last tier required an independent canary HTTP receipt. Tool compliance, outbound communication and verified transfer must not be called the same outcome. No production victim or actual stolen secret is established by these fixtures. Scoring rules and Table 6.
The failure boundary is the model treating tool descriptions or returned content as an instruction to execute a command, read a secret, or call an external endpoint. A trustworthy application must enforce each tool's task scope and network policy at dispatch; sanitizing the final answer alone is too late. By contrast, the SurrealDB MCP session issue was a backend identity collision independent of the model's interpretation of poisoned text.
Mechanism and trust boundary
- 01
Serve attacker-controlled tool content
A lower-trust MCP response presents adversarial instructions inside material the agent needs for a legitimate task.
Boundary: Remote tool result to the agent context
- 02
Promote returned text into action guidance
The agent may treat content about its next steps as if it came from the user or trusted application policy.
Boundary: Data content to instruction authority
- 03
Attempt a forbidden downstream effect
Selected variants induced disallowed behavior including canary exfiltration, which was verified separately from broader vulnerability classifications.
Boundary: Model-generated request to external tool permission enforcement
Claims & evidence
CLM-NOV04-MCPVENOM-TOOL-OUTPUT-1MCPVenom designed 9,720 framework-model-scenario cells: 2,113 were labeled vulnerable, 7,102 resistant, 237 errored and 268 skipped. The study's 22.9% attack-success rate is 2,113 of the 9,215 vulnerable-or-resistant cells, not 2,113 divided by all 9,720 designed cells.supported
Basis: reported finding
- supportsMCPVenom: benchmark of tool-output prompt injection in MCP agent frameworksprimary disclosure
Section 6.1, Table 3, Total row (V=2,113; R=7,102; E=237; S=268; ASR 22.9%)
CLM-NOV04-MCPVENOM-TOOL-OUTPUT-2The authors separately verified 255 canary exfiltration outcomes, which is not the same quantity as all vulnerable outcomes.supported
Basis: reported finding
- supportsMCPVenom: benchmark of tool-output prompt injection in MCP agent frameworksprimary disclosure
Canary exfiltration verification results
CLM-NOV04-MCPVENOM-TOOL-OUTPUT-3Among 2,113 vulnerable outcomes, the authors reported 1,371 dispatch-level events, 487 confirmed network contacts and 255 canary-secret exfiltration receipts; their headline 22.9% rate excludes error or skipped cells from its effective denominator.supported
Basis: reported finding
- supportsMCPVenom: benchmark of tool-output prompt injection in MCP agent frameworksprimary disclosure
Section 6, Tables 4 and 6; dual-oracle definitions
Implications
MCP security requires typed trust provenance on results and enforcement of task-specific tool capabilities before side effects; treating model refusal as the only line of defense is insufficient.
Controls and mitigations
- Separate tool-response data from system/user instructions and annotate provenance at ingestion.
- Enforce tool allowlists, data egress rules and user approval at the executor, not only in the prompt.
- Regression-test identical malicious tool results against both allowed and disallowed action policies.
- Restrict tool execution to the authorized task and require external network policy to prevent unauthorized reads or canary-style exfiltration, regardless of model interpretation of tool descriptions.
Unknowns and contradictions
- The 255 canary events do not establish real-world victim losses or deployment prevalence.
- The tested framework/model matrix does not establish behavior for all versions or configurations.
Sources and citation
Material revision history
- Nov 4, 2026 · Published version · first publication · revision 218