An MCP server's optional `instructions` field lands attacker prose in the agent's context before the first tool call.

Mike Moore of Solo.io published a red-team lab September 19 showing four attacks through the server-authored instructions field, which sits outside individual tool definitions. A direct override. A directive buried in 24,000 characters. A change to already-approved instructions after several discovery requests. And a response marked cacheScope: "public" so a shared proxy serves poisoned text to a caller that never contacted the hostile server. All four run with no model in the loop and all four are blocked by isolation, a 4,096-character cap, caller-bound cache keys and a change-rejecting digest. An August registry audit found 5,462 of 8,235 responding servers populate the field, median 577 characters, max 68,669. Claude Code loads server instructions at session start with a 2KB cap, which kills the volume attack but not a short hostile paragraph.