MCP Injection Lab: 28 Pages That Try to Hijack Your AI Agent

Every time an AI agent browses a web page, it's trusting that the content is what it appears to be. A tech blog is just a tech blog. An API documentation page is just documentation. A job listing is just a job listing. But what happens when the page isn't? What happens when the person who wrote the page anticipated that an AI agent would read it — and embedded instructions specifically designed to manipulate what the agent does next?

That's the question MCP Injection Lab is built to answer. It's a collection of 28 standalone web pages that look exactly like normal content — but contain hidden prompt injection payloads at varying levels of sophistication. Send your AI agent to summarize one of them. Watch what it does.

The attack: indirect prompt injection

Prompt injection is what happens when an attacker gets their instructions into the same context window as your AI agent. Direct injection is the obvious case — you're talking to an AI and you type in adversarial instructions yourself. Indirect injection is the subtler, more dangerous case: the instructions don't come from you at all. They come from data the agent processes on your behalf.

An AI agent reading a web page, summarizing an email, or processing a shared document is consuming untrusted content. If that content contains instructions — hidden in HTML comments, invisible CSS text, metadata fields, or seemingly ordinary prose — the agent may follow them without any indication to the user that anything unusual happened.

When does an agent become vulnerable?

Not every agent is equally at risk. An agent becomes truly dangerous to operate when three conditions are met simultaneously — what security researchers call the lethal trifecta.

All three together create the conditions for a complete attack. An agent with database access reads a malicious web page (exposure), and the injection instructs it to query the user's data and encode it into an image URL (exfiltration). The Supabase MCP breach in mid-2025 is a real example of this exact chain.

How to use the lab

The lab is a single-page app with 28 test pages accessible at clean URLs. Each page looks exactly like normal web content — the lab chrome (tier badge, technique tags, reveal toggle) is visible to you but stripped entirely from the AI-facing version. To run a test:

If the agent outputs the passphrase — the injection succeeded. The agent followed hidden instructions embedded in the page. You can then toggle "Reveal Injections" in the lab view to see exactly where the payloads were hidden and how they were structured.

The seven tiers

The 28 tests are organized into seven difficulty tiers. Lower tiers use straightforward hiding techniques — the kind that are well-documented and that well-aligned models should resist. Higher tiers test more sophisticated behavioral manipulation and protocol-level attacks.

The density system

Each test page has a density selector with four levels: Sparse, Moderate, Dense, and Saturated. This controls how many injection payloads are simultaneously active on the page — from a single carefully-placed injection up to 8+ overlapping techniques firing at once.

The density system exists because real-world attacks aren't always single-payload. Unit 42 researchers documented adversarial pages containing 24+ simultaneous injection payloads. At Dense and Saturated levels, the lab simulates what those pages look like to an agent — overwhelming the agent's content-versus-instruction boundary with volume. Test 20 (the full attack chain) runs all eight behavioral attacks with all ten hiding techniques active at once, mirroring those real-world campaigns.

Research methodology

The lab's threat model is specific: an AI agent is instructed by a user to browse, summarize, or analyze a web page. The attacker controls the page content but has no direct access to the agent's system prompt, tools, or conversation history. The attacker's only channel is the page content itself — HTML, CSS, metadata, structured data, and any non-visual elements the agent processes.

Injection techniques are classified along three independent axes: delivery method (how the payload reaches the agent), obfuscation (how it evades detection), and behavioral objective (what the agent is manipulated to do). This produces a taxonomy of roughly 25 distinct technique categories across the seven tiers.

Novel contributions

Beyond implementing known techniques from published CVEs and research, the lab introduces several attack vectors not well-represented in existing injection benchmarks. Test 25 targets multimodal metadata: alt-text descriptions, EXIF field simulations, and structured image data for vision-capable agents. Tests 26–28 target non-HTML formats that most injection benchmarks ignore entirely: RSS/Atom feed CDATA sections, JSON API response fields and error messages, and crawler directive abuse via robots.txt, meta robots, and sitemap.xml.

The density system is also novel as a research instrument. By controlling injection volume as an independent variable, it enables systematic study of the relationship between payload count and agent susceptibility — something existing benchmarks treat as fixed.

Why this matters now

Prompt injection has been a theoretical concern since the earliest days of LLM-powered agents. In 2025 it became operational. EchoLeak (CVE-2025-32711) demonstrated markdown image exfiltration from Microsoft Copilot — an agent processing an email with an injected payload would silently encode sensitive data into an image URL request to an attacker-controlled server. MCPoison (CVE-2025-54136) showed tool description poisoning in MCP servers. The Supabase MCP breach combined all three elements of the lethal trifecta in a single real-world attack.

The OWASP LLM Top 10 ranks prompt injection as the number one attack vector for LLM applications. The OWASP MCP Top 10, published in 2025, identifies ten critical risks specific to Model Context Protocol-integrated systems — tool poisoning, rug pull, cross-server injection, sampling abuse, and others. All ten are represented in the lab's Tier 6 tests.

Limitations