Research demo
Line jumping: MCP servers can inject prompts through tool descriptions before any tool is invoked
AIR-2025-0026 AIR record · 2025-04-trailofbits-mcp-line-jumping
From the supporting source
MCP servers can manipulate model behavior _without ever being invoked_.blog.trailofbits.com
The record
Disclosed
2025-04-21
Vendor
multiple
Product
Claude Desktop, Cursor, Cline, Windsurf
Risk domain
Tool misuse › Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted (contested) — tool descriptions hijacked the agent before any tool was invoked
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Malicious tool description
Impact type
Agent hijack, Approval bypass
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Every MCP client that loads third-party tool descriptions into context
Capability abused
Defense & remediation
Recorded defense
Human-in-the-loop tool approval
Guardrail kinds
Human approval
Guardrail outcome
Silent
Taxonomy & references
Curator notes
Trail of Bits' name for what others call tool poisoning. Quote retains the source's markdown emphasis markers. Also: 'This effectively transforms the human-in-the-loop security model into human-as-the-rubber-stamp.'
Supporting sources
Cite as
Enkrypt AI. "Line jumping: MCP servers can inject prompts through tool descriptions before any tool is invoked". AIR, AIR-2025-0026. https://agentincident.vercel.app/i/AIR-2025-0026/ (accessed 2026-10-19).