MCP prompt injection: limit what a hijacked agent can do

MCP prompt injection is text an agent reads through an MCP connection, such as a web page, a file, or a tool result, that carries instructions the model then follows, like calling a tool nobody asked for. You can't count on the model to notice, so bound what a hijacked turn can do: expose only the tools the job needs, keep the session read-only unless it must write, have a person confirm every tool that isn't read-only, and keep credentials out of the model's context.

The client rules come from the MCP specification's Tools and Schema pages and OpenAI's ChatGPT developer mode page; Sume's controls come from its MCP quickstart, MCP tools and gates, MCP OAuth and API keys, and Safe automation docs, all read on 2026-09-27. For caller data passed into a Sume run over the API, see Prompt injection and user input.

What does the MCP spec ask clients to do?

The spec calls tools model-controlled: the model can discover and invoke them on its own. For trust and safety, it says there should always be a human in the loop who can deny tool invocations, and it lists what clients should do:

• Make clear which tools are exposed to the model, and show when a tool is invoked.
• Ask the user to confirm sensitive operations.
• Show tool inputs before calling the server, to avoid malicious or accidental data exfiltration.
• Validate tool results before passing them to the model.
• Time out tool calls, and log tool usage for audit.

Why isn't readOnlyHint enough on its own?

Tool annotations are hints: the spec says they are not guaranteed to describe a tool faithfully, and that clients should never make tool-use decisions based on annotations from untrusted servers (MCP tool annotations covers each hint). For a server you trust, clients such as ChatGPT use them: its developer mode respects readOnlyHint, treats tools without it as write actions, and requires confirmation for write actions by default. OpenAI's page warns about prompt injections, model mistakes on write actions, and malicious MCP servers that try to steal information.

Sume's current server marks its read tools readOnlyHint: true and its write and paid tools readOnlyHint: false, so a client like ChatGPT asks before a paid call. The weak spot is a remembered approval: ChatGPT can apply an approve choice to a tool for the rest of a conversation, and after that an injected instruction reaches the tool without a prompt. OpenAI says to do that only for applications you trust to make further write actions without your approval.

How do Sume's MCP settings limit an injected call?

Sume's docs describe no way to detect injected text; the controls in the table below bound access and spend instead.

dry_run and max_spend_usd are arguments the model writes. An honest agent previews cost with dry_run=true and caps it with max_spend_usd; a hijacked turn can leave both out. The limits that hold sit outside the model: the session's scope, the client's tool list, and a person confirming each paid call. Sume's authentication docs say to give agents read-only commands first and require explicit confirmation before write or paid generation commands.

What should never reach the model's context?

Anything an injected instruction could ask the model to repeat or send somewhere else. Sume's docs say an MCP OAuth token is not an API key; not to store OAuth tokens in CLI config, paste them into prompts, or forward them to third-party providers; not to paste signed URLs, OAuth tokens, or API keys into chat logs; and to rotate API keys that appear in logs or chat history.

Logs follow the same rule. Safe automation for AI agents that call paid APIs lists what Sume's docs call safe and unsafe to log.