Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-10 · source-backed
Unit 42 documented an attack class where a malicious MCP server abuses the sampling capability, asking your client LLM to generate text on the server's behalf, to smuggle injected instructions back into the host agent's reasoning. Because the content originates server-side, it sails past naive input filters that only inspect the user turn. Sanitize and template sampling payloads, require explicit approval for tool execution, and isolate sampling context so a server can't quietly steer your main task.
Each link below shares sources, entities, or timing with this story.
Microsoft supports MCP / Shared entities / Same source domain / Shared topic / What happened next / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover LLM, MCP, Unit; reported by the same outlet (unit42.paloaltonetworks.com).
Anthropic released MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Anthropic released MCP); both cover LLM, MCP; overlapping topics (agent, context, documented, server).
Cursor uses MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover LLM, MCP; overlapping topics (agent, back, context).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses MCP); both cover LLM, MCP; overlapping topics (agent, context).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover LLM, MCP; overlapping topics (agent, attack, context).
Linked by a graph relationship (Claude Code uses MCP); both cover LLM, MCP; overlapping topics (agent, client, server).
Windsurf uses MCP / Shared entity: MCP / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Windsurf uses MCP); both cover MCP; overlapping topics (attack, capability, class, server).
Microsoft supports MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Microsoft supports MCP); both cover LLM, MCP; overlapping topics (agent, context).