Research · curated 12 Sep 2026
No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
MCPSec shows that indirect prompt injection risk in real MCP server deployments can be systematically identified from tool descriptions alone, giving defenders a scalable way to audit closed-source or remotely hosted agent tooling before it is weaponized.
Researchers from Arizona State University introduce MCPSec, a "no-box" vulnerability analysis pipeline that detects indirect prompt injection vulnerabilities in Model Context Protocol (MCP) servers using only the tool metadata exposed at server registration time, without source code or runtime interaction. Evaluated on 20 widely deployed MCP servers comprising 177 tools (95 human-confirmed vulnerable), MCPSec flagged 143 tools and recovered 94 confirmed vulnerabilities (98.9% recall) versus 84.2% for an LLM baseline, producing hypothesized attack scenarios (Theory of Concepts) for later validation.