Model Context Protocol

A researcher shows that Deep Research agents in ChatGPT can leak data between connected tools, since all connectors and MCP servers share one trust boundary. Data from one source, such as Outlook email, can be used in queries sent to another source, such as a custom Remote Matrix MCP server, and an attacker can force this through prompt injection. The custom connector must implement exactly search and fetch, and the research was conducted about two months before publication.

Researcher Johann Rehberger describes an attack chain against Amp, an agentic coding tool built by Sourcegraph, in which the agent could write to the user's VS Code settings.json file outside the project folder without approval. An attacker, or the model itself through indirect prompt injection, could add wildcard or malicious entries to the allowlisted bash commands or add a malicious MCP server, achieving arbitrary code execution on the developer's machine. The issue was reported to Sourcegraph and fixed within a few days.

A researcher found that Anthropic's filesystem MCP server validates allowed paths with a .startsWith comparison in the validatePath function of index.ts, without checking that the path is a directory. As a result, a directory allowlisted through allowedDirectories, such as /mnt/finance/data, also grants access to sibling paths sharing the same prefix, such as /mnt/finance/data-archived. The researcher reported the issue to Anthropic on June 1, 2025, and Elad Beber had independently reported it earlier.

iOS Simulator MCP Server (ios-simulator-mcp) versions prior to 1.3.3 are vulnerable to command injection through the `ui_tap` tool, which passes LLM-supplied `duration`, `udid`, `x` and `y` arguments into Node.js `exec`. Shell meta-characters in these inputs, which prompt injection can induce, let an attacker run arbitrary commands on the host running the MCP server. Tracked as CVE-2025-52573.

A security advisory reports a data leakage and exfiltration vulnerability in Anthropic's Slack MCP Server, a reference implementation now deprecated and unmaintained. The server does not disable link unfurling when posting to channels, so an AI agent that posts links can leak data, such as secrets from a .env file, to third-party servers, and a prompt injection can trigger this. The advisory says the server appears widely used, with 14k+ weekly downloads.

The author explains that the Model Context Protocol (MCP) lets LLM apps and agents discover and use external tools at runtime, unlike static setups such as OpenAPI. The author argues that because of prompt injection, MCP tool servers effectively control the client. The post promises a detailed explanation and a novel exploit chain.