An MCP server's optional instructions field lands attacker prose in the agent's context before the first tool call
Mike Moore of Solo.io published a red-team lab on 2026-09-19 showing that MCP's server-authored instructions field, which sits outside individual tool definitions and is returned during initialize in older versions or via server/discover in the 28 July 2026 spec, is a prompt-injection route the industry's tool-definition-focused defenses do not cover. Four scenarios run with no model in the loop: a direct override, a directive buried in a 24,000-character payload, a change to already-approved instructions after several discovery requests, and a response marked cacheScope "public" so a shared proxy serves the poisoned text to a second caller that never contacted the hostile server. All four reach the harness's trusted prompt region or cross its caller boundary undefended and all four are blocked by isolation, a 4,096-character cap, caller-bound cache keys and a change-rejecting digest. An August registry audit found 5,462 of 8,235 responding servers (66%) populate the field, median 577 characters and max 68,669; Claude Code loads server instructions at session start with a 2KB cap, which strips the volume attack but not a short hostile paragraph.
Source
↳ Follow the thread