Splitting a prompt-injection payload across two MCP channels took models that resist single-channel injection to 100% credential exfiltration

arXiv 2609.18217·high signalXBlueskyLinkedInCopy link

MCP exposes an LLM to attacker-controlled text through at least three channels that share one context window with no privilege separation: tool descriptions, tool results, and sampling messages. This paper builds cross-channel fragmentation attacks that distribute a payload across those channels, and across 12 models and over 15,000 trials reports models resistant to single-channel injection reaching up to 100% credential exfiltration under a two-channel attack. Every evaluated security tool failed to detect the fragmented payloads. The defensive implication is concrete: scanners that grade each channel in isolation cannot see this class, so the check has to run over the assembled context, not per-channel.