Threat · curated 1 Sep 2026

I broke an MCP server in 10 minutes — the exact prompt injection attack chain (with fixes)

First reported today dev.to

Coverage timeline

Single-source research — first reported, latest, and curated coincide.

Why it matters

MCP servers that fail to separate untrusted content from instructions let attacker-supplied documents chain tools and exfiltrate data, a pattern the author says is common across average production deployments.

A DEV Community write-up demonstrates an indirect prompt injection attack chain against a typical MCP server exposing read_file and send_email tools, where a submitted document containing a fake 'SYSTEM NOTE' instruction causes the model to exfiltrate /etc/passwd by email because no boundary separates data from instructions. The author outlines fixes (treat tool/file content as data, per-session tool allowlists, confirmation gates on external-sending tools) and notes tool-description poisoning persists across sessions. The post also promotes a free hosted scanner.