Line jumping: how a poisoned MCP tool hijacks a model that was never called

Sun, 05 Jul 2026 00:00:00 +0000

Most MCP security write-ups tell you each server is “a new trust boundary.” True, and useless — because it makes you picture a door you choose to walk through. The real problem is that you don’t. The dangerous instruction runs the instant you connect the server, before you invoke anything. The attack fires at handshake time, not at call time.

Here is the protocol detail that makes MCP different from every integration you’ve audited before. When a client connects, it calls tools/list and the server returns each tool’s name, input schema, and a natural-language description. That description is not shown to the model when the tool is called — it’s loaded into the model’s context immediately, at tools/list time, so the model knows which tools exist and when to reach for them. The description is in the prompt from the first token of the conversation onward.

Indirect prompt injection is SSRF for the agent era

Fri, 03 Jul 2026 00:00:00 +0000

Most write-ups tell you prompt injection is “when the model follows instructions in its input.” True, and useless — because that framing makes it sound like a chatbot quirk you patch with a better system prompt. It isn’t. It’s an architecture bug you already know by another name.

SSRF happened because a server would fetch a URL you controlled and trust the response. Indirect prompt injection happens because an agent reads content you control — a web page, a PDF, an email, a calendar invite — and trusts it as instructions. Same defect, new medium. The server-side fetch became a model-side read; the trusted response became a trusted command.

Agentic Security on Crusader Research

Line jumping: how a poisoned MCP tool hijacks a model that was never called

Indirect prompt injection is SSRF for the agent era