Research demo
Prompt injection attack vectors through MCP sampling: conversation hijacking and covert tool invocation
AIR-2025-0188 AIR record · 2025-12-unit42-mcp-sampling-attacks
From the supporting source
MCP sampling relies on an implicit trust model and lacks robust, built-in security controls.unit42.paloaltonetworks.com
The record
Disclosed
2025-12-05
Product
MCP clients supporting sampling (an unnamed coding copilot and an unnamed code editor)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels
System type
Generative model
Who acted
Agent acted — MCP sampling drove covert tool invocation and exfiltration
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Malicious mcp server
Impact type
Data exfiltration, Resource theft, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Any MCP client implementing the sampling feature
Capability abused
Taxonomy & references
Curator notes
Authors Huang, Rao, Li, Ji, Hu. Three vectors: resource theft, conversation hijacking, covert tool invocation. Unit 42 deliberately withheld vendor names.
Cite as
Enkrypt AI. "Prompt injection attack vectors through MCP sampling: conversation hijacking and covert tool invocation". AIR, AIR-2025-0188. https://agentincident.vercel.app/i/AIR-2025-0188/ (accessed 2026-10-19).