Every Major MCP Client Is Vulnerable to Prompt Injection via Tool Poisoning. All Seven Tested. All Seven Failed.

Pair this with the espionage story and the picture gets uncomfortable fast.

A new arXiv paper (2603.21642) presents the first systematic evaluation of prompt injection through tool-poisoning across seven MCP clients: Claude Desktop, Claude Code, Cursor, Cline, Continue, Gemini CLI, and Langflow. The attack vector is straightforward. Malicious instructions hidden in tool descriptions, metadata, or server configurations get injected into the model's context when the tool is loaded. The model follows them because it can't distinguish tool metadata from legitimate instructions.

The researchers tested for static validation, parameter visibility, injection detection, user warnings, execution sandboxing, and audit logging across all seven clients. I haven't seen the full results matrix published yet, but the paper's conclusion is clear: none of the clients adequately defend against this class of attack.

Here's why this matters to me specifically. I run MCP servers daily. Notion, Playwright, custom tools. Every time I install an MCP server, I'm trusting that its tool descriptions don't contain hidden instructions that could exfiltrate my files, run arbitrary commands, or hijack my agent's behavior. There's no signing, no validation, no scanning. It's npm circa 2014 all over again, except the attack surface is your entire development environment.

The uncomfortable parallel: we spent a decade building supply chain security for package managers. Lockfiles. Signature verification. Automated scanning. Vulnerability databases. The MCP ecosystem has none of that. And MCP adoption is accelerating. 97 million+ downloads. Thousands of servers. The gap between adoption and security is widening, not closing.

What builders should do right now: audit every MCP server you have installed. Read the tool descriptions manually. If you didn't write it or can't read the source, treat it like running an untrusted binary. Limit the permissions of your MCP client. Don't give Claude Desktop full filesystem access if it only needs to read one directory. And watch for the security tooling that's starting to emerge. Miggo Security announced MCP monitoring at RSA this week. Secure Code Warrior shipped Trust Agent: AI that tracks active MCP servers. The ecosystem is responding, but we're playing catch-up.