# MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)

- **Severity:** High
- **Signature ID:** `fc14b3a5-4f93-434b-ab76-2103243cd0cb`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM05 (Improper Output Handling), LLM10 (Unbounded Consumption)

## Summary

The Model Context Protocol (MCP) lets AI tools call out to external servers for extra capabilities. A malicious or compromised MCP server can abuse a feature called 'sampling' to send the host AI hidden instructions disguised as normal completion requests, effectively putting the server in control of what the AI thinks and does next.

## How the attack works

Normally, the user's prompt drives the AI and the MCP server just supplies data or tools. With sampling, the flow reverses: the server itself sends a `sampling/createMessage` request back to the host AI, and it can control both the prompt content and how the AI should treat the reply. A malicious server appends hidden instructions to an otherwise legitimate request — things like overriding the system role, adding 'after finishing X, also do Y', or 'in all future responses, do Z' to make the injection persist across the conversation. It can also quietly tell the AI to invoke another tool (like a file or network tool) without showing this to the user. Combined with a setting that pulls in the server's own context and sends output to an external URL, this can be used to exfiltrate data.

## Why it matters

An organization using a compromised or malicious MCP server risks unbilled resource consumption (forced extra generation), silent hijacking of the AI's behavior across an entire conversation, and covert actions like file access or data exfiltration that the user never sees or approves.

## What you can do

- Only connect AI agents to MCP servers you trust and have reviewed; treat sampling requests as untrusted input just like any other server-supplied data.
- Log and review sampling/createMessage traffic, watching for system-prompt overrides, 'in all future responses' persistence language, or instructions to invoke other tools.
- Require explicit user visibility and approval before an AI agent acts on tool-invocation instructions that originated from a server rather than the user.
- Restrict or disable includeContext settings that pull server-side context together with the ability to send output to external URLs, unless specifically needed.

## Known benign look-alikes

- Legitimate MCP sampling requests whose systemPrompt and messages contain only the task description (summarize, translate, classify) with no appended hidden instructions.
- MCP documentation or SDK examples that show the sampling/createMessage shape, including includeContext: thisServer, without an injection payload.
- Red-team / security-testing fixtures that reference these patterns inside an explicitly labelled test harness.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01930

---
Source: https://www.netzilo.com/threats/atr-mcp-sampling-prompt-injection-server-to-client-createmessage