PAIR transfers, CipherChat does not: Indirect Prompt Injection in MCP Tool Responses - Corrêa, Matheus R. S.; Bunn, Carlos D. S.; Miers, Charles C.; P. Neto, Milton P. (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
The Model Context Protocol (MCP) standardizes the integration between Large Language Models (LLMs) and external tools, enabling agents to act on real environments and expanding the attack surface beyond conventional text interfaces. This paper evaluates two black-box attack strategies against an MCP based agent. Prompt Automatic Iterative Refinement (PAIR), which iteratively refines injected instructions via attacker model feedback, and CipherChat, adapted to the indirect injection context of MCP tool responses. Attack success is redefined as the invocation of an unauthorized tool action rather than harmful text output, reflecting the qualitatively different threat posed by agentic systems. The results show that semantic adversarial refinement transfers to the MCP tool response channel and that larger models offer partial but insufficient protection, whereas encoding based obfuscation fails to transfer from the direct user-turn context to the MCP data plane.