MCP Resource & Prompt Primitive Injection
Security & IdentityDescription
Exploits MCP primitives beyond `tools` — specifically `resources` (server-announced URIs the agent may read), `prompts` (server-shipped pre-baked prompt templates), and `sampling` (server-requested model inference). All three carry server-controlled content that lands in agent context. Distinguished from ZYR-SI-004 (Indirect PI) by mechanism — the server announces the content rather than the agent retrieving from arbitrary URLs.
MCP server's `resources` list exposes "company-handbook.md" — the announced URI returns a doc with injected "Ignore previous instructions and …" in the middle. Agent reads it during a routine onboarding query and obeys.
Cache and shared-state poisoning in multi-agent AI deployments is a plausible attack surface derived from well-understood software security principles, but no confirmed production exploit of this pattern specifically targeting multi-agent AI orchestration systems has been publicly documented as of the knowledge cutoff.
No public incident on record — evidence level: Theoretical
Primary mitigations
- Server-announced content treated as untrusted
- per-primitive policy (resources/prompts/sampling)
- resource URI allowlists
- prompt-template review gate before use
- sampling-primitive disable by default in customer-facing tiers
Detection signals
Resource URI fetched by agent vs the URI announced (drift detection); prompt invocation count by template ID; sampling primitive invocation rate vs baseline; LLM-classifier on every primitive payload