System Prompt Override Injection via MCP Tool
AI agents that use the Model Context Protocol (MCP) load tool descriptions from external servers or plugins. An attacker can write text into those descriptions or parameters that looks like a system instruction, tricking the agent into ignoring its real rules.
How the attack works
An attacker controls or compromises an MCP tool's metadata, such as its name, description, or parameter fields. That text is crafted to resemble a system prompt, for example instructions claiming to override prior rules or grant new permissions. When the agent loads the tool and includes its description in the model's context, the model may treat the injected text as a legitimate instruction rather than untrusted data. This can cause the agent to bypass safety controls, change its behavior, or act outside its intended scope.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f24b5949-a99f-4778-a600-db3cb955f714
- Severity
- High
Why it matters
An attacker can hijack an AI agent's behavior through a tool it trusts, potentially bypassing safety restrictions, exfiltrating data, or getting the agent to perform unauthorized actions, all without touching the user's own prompt.
What you can do
- →Review and restrict which MCP servers and tools an agent is allowed to load, especially third-party or user-supplied ones.
- →Treat tool descriptions and parameters as untrusted input; do not let them be concatenated into the system prompt without sanitization.
- →Log and monitor changes to tool metadata over time so injected overrides are visible.
- →Test agents with known prompt-injection patterns embedded in tool descriptions before deploying new integrations.
Known benign look-alikes
- Documentation explaining how system prompts work in educational context
- Security tools that legitimately test for prompt injection vulnerabilities