Public story · 2026-03-17 · source-backed

Unit 42 Documents MCP Sampling Prompt Injection.

Issue

2026-03-17

Confidence

source-backed

Sources

Redaction

redacted

Story

Palo Alto Networks' threat research team published analysis of attacks exploiting MCP's sampling feature — resource theft via hidden instructions consuming API credits undetected, and conversation hijacking via persistent instructions from compromised servers. Source

Microsoft supports MCP / Shared entities / Same source domain / What happened next / Tension
36.7% of scanned MCP servers are exposed to SSRF, 42% leak credentials
Linked by a graph relationship (Microsoft supports MCP); both cover MCP, Unit; reported by the same outlet (unit42.paloaltonetworks.com).
Microsoft supports MCP / Shared entity: MCP / Shared topic / What happened next / Tension
A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It
Linked by a graph relationship (Microsoft supports MCP); both cover MCP; overlapping topics (attack, injection, instruction).
Claude Code uses MCP / Shared entity: MCP / Shared topic / What happened next
Every Major MCP Client Is Vulnerable to Prompt Injection via Tool Poisoning. All Seven Tested. All Seven Failed.
Linked by a graph relationship (Claude Code uses MCP); both cover MCP; overlapping topics (attack, hidden, injection, instruction).
OpenAI supports MCP / Shared entities / Same source / Earlier coverage
Skills You Should Learn This Week
Linked by a graph relationship (OpenAI supports MCP); both cover MCP, Unit; cite the same source (Source).
Hermes Agent supports MCP / Shared entity: Unit / Same source domain / What happened next
A Chinese-speaking operator wired DeepSeek into an open-source agent framework and hit 460+ hosts.
Linked by a graph relationship (Hermes Agent supports MCP); both cover Unit; reported by the same outlet (unit42.paloaltonetworks.com).
Windsurf uses MCP / Shared entity: MCP / Shared topic / What happened next
9 of 11 MCP Registries Successfully Poisoned. Zero-Click Prompt Injection in Windsurf and Cursor.
Linked by a graph relationship (Windsurf uses MCP); both cover MCP; overlapping topics (attack, injection).
Microsoft supports MCP / Shared entity: MCP / Shared topic / What happened next
TeamPCP Goes Multi-Ecosystem: CanisterWorm Hits npm, LAPSUS$ Collaboration Surfaces, and a Bug in the Attacker's Own Code Was the Only Thing That Caught It
Linked by a graph relationship (Microsoft supports MCP); both cover MCP; overlapping topics (attack, compromised).
Anthropic released MCP / Shared entity: MCP / Shared topic / Earlier coverage
MCP CVEs Hit 30 — Attack Surface Expanding to Developers
Linked by a graph relationship (Anthropic released MCP); both cover MCP; overlapping topics (attack, injection).

Source trail

Source

Entities

Documents MCP Sampling Prompt Injection MCP Palo Alto Networks Unit

Provenance

Canonical issue: Ramsay Research Agent — 2026-03-17
AI generated: no
Story unit: 2026-03-17-unit-42-documents-mcp-sampling-prompt-injection
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

Unit 42 Documents MCP Sampling Prompt Injection.

Story

Related stories

36.7% of scanned MCP servers are exposed to SSRF, 42% leak credentials

A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It

Every Major MCP Client Is Vulnerable to Prompt Injection via Tool Poisoning. All Seven Tested. All Seven Failed.

Skills You Should Learn This Week

A Chinese-speaking operator wired DeepSeek into an open-source agent framework and hit 460+ hosts.

9 of 11 MCP Registries Successfully Poisoned. Zero-Click Prompt Injection in Windsurf and Cursor.

TeamPCP Goes Multi-Ecosystem: CanisterWorm Hits npm, LAPSUS$ Collaboration Surfaces, and a Bug in the Attacker's Own Code Was the Only Thing That Caught It

MCP CVEs Hit 30 — Attack Surface Expanding to Developers

Source trail

Entities

Provenance

Unit 42 Documents MCP Sampling Prompt Injection.

Story

Related stories

36.7% of scanned MCP servers are exposed to SSRF, 42% leak credentials

A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It

Every Major MCP Client Is Vulnerable to Prompt Injection via Tool Poisoning. All Seven Tested. All Seven Failed.

Skills You Should Learn This Week

A Chinese-speaking operator wired DeepSeek into an open-source agent framework and hit 460+ hosts.

9 of 11 MCP Registries Successfully Poisoned. Zero-Click Prompt Injection in Windsurf and Cursor.

TeamPCP Goes Multi-Ecosystem: CanisterWorm Hits npm, LAPSUS$ Collaboration Surfaces, and a Bug in the Attacker's Own Code Was the Only Thing That Caught It

MCP CVEs Hit 30 — Attack Surface Expanding to Developers

Source trail

Entities

Provenance