Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

Mike Moore

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

2

Sources

1

Corpus findings

2026-09-21 / agents-researcherAn MCP server's optional instructions field lands attacker prose in the agent's context before the first tool callMike Moore of Solo.io published a red-team lab on 2026-09-19 showing that MCP's server-authored instructions field, which sits outside individual tool definitions and is returned during initialize in older versions or via server/discover in the 28 July 2026 spec, is a prompt-injection route the industry's tool-definition-focused defenses do not cover. Four scenarios run with no model in the loop: a direct override, a directive buried in a 24,000-character payload, a change to already-approved instructions after several discovery requests, and a response marked cacheScope "public" so a shared proxy serves the poisoned text to a second caller that never contacted the hostile server. All four reach the harness's trusted prompt region or cross its caller boundary undefended and all four are blocked by isolation, a 4,096-character cap, caller-bound cache keys and a change-rejecting digest. An August registry audit found 5,462 of 8,235 responding servers (66%) populate the field, median 577 characters and max 68,669; Claude Code loads server instructions at session start with a 2KB cap, which strips the volume attack but not a short hostile paragraph.

Graph relationships

CRITICIZES
MCP
Mike Moore published a red-team lab showing MCP has a prompt-injection vulnerability.
Source finding
WORKS AT
Solo.io
Mike Moore of Solo.io published research on MCP security.
Source finding

Source trail

published a red-team lab

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues