MCP Injection Lab

About MCP Injection Lab

MCP Injection Lab is an educational security research tool designed to help developers, security researchers, and AI practitioners understand the risks of indirect prompt injection attacks against AI agents.

As AI agents increasingly browse the web, read documents, and interact with external tools via protocols like MCP (Model Context Protocol), they become vulnerable to adversarial content embedded in the data they process. This testing range provides a safe environment to evaluate how well your AI agent resists these attacks.

The "Lethal Trifecta"

An AI agent becomes vulnerable to indirect prompt injection when three conditions are met simultaneously:

Enterprise Attack Surface

Prompt injection attacks are not theoretical — they affect real enterprise tools. The table below maps injection techniques to common enterprise platforms:

Real-World CVEs

These vulnerabilities have been documented in production AI systems:

MCP Attack Surface

The Model Context Protocol (MCP) amplifies traditional prompt injection attacks by providing agents with powerful tool-use capabilities. Research identifies three core MCP vulnerabilities:

Attack Amplification: MCP vs Non-MCP

ATTESTMCP Defense Framework

ATTESTMCP is a proposed defense framework that addresses MCP\'s core vulnerabilities through four mitigations:

• Capability Attestation: Cryptographic signing of tool capabilities so agents can verify server identity and authorized functions.
• Message Authentication: All MCP messages carry authenticated origin headers, preventing injection from unauthorized sources.
• Origin Tagging: Every piece of data processed by the agent is tagged with its origin server, enabling trust-level differentiation.
• Isolation Enforcement: Strict sandboxing between MCP servers prevents cross-server lateral movement and data leakage.

In testing, ATTESTMCP reduced overall attack success rate from 52.8% to 12.4% — a 76.5% reduction.

OWASP MCP Top 10

The OWASP Model Context Protocol Top 10 identifies the most critical risks for MCP-integrated AI systems:

Key Statistics

In 2025, there were an estimated 16,200 AI security incidents reported globally, with prompt injection ranking as the #1 attack vector against AI agents according to the OWASP LLM Top 10.

Tier 5: Behavioral Attacks — The Most Dangerous Class

Traditional prompt injection tests ask: "Did the agent reveal a passphrase?" Behavioral attacks ask a more dangerous question: "Did the agent change what it does?" The 8 Tier 5 tests in this lab simulate the most sophisticated attack patterns observed in production AI systems.

Resources

• OWASP LLM Top 10 — Comprehensive ranking of LLM security risks
• OWASP MCP Top 10 — Model Context Protocol specific risks
• CrowdStrike AI Threat Taxonomy — Classification of AI-specific threats
• Unit 42 Research — Palo Alto Networks threat intelligence on AI attacks
• MCP Security Analysis — Research on Model Context Protocol attack vectors
• F5 CASI/ARS Leaderboards — AI agent safety and response leaderboards
• Gray Swan Arena — Indirect prompt injection challenge leaderboard
• ATTESTMCP Paper — Capability Attestation and Message Authentication for MCP Security

Research Methodology

A whitepaper on the design, taxonomy, and research foundations behind MCP Injection Lab.

1. Threat Model

MCP Injection Lab operates under a specific threat model: an AI agent is instructed by a user to browse, summarize, or analyze a web page. The attacker controls the web page content but has no direct access to the agent's system prompt, tools, or conversation history. The goal is to manipulate the agent into performing unintended actions through content embedded in the page.

This models the real-world scenario where AI agents browse the open web via MCP web_fetch tools, search result summarizers, or document analysis pipelines. The attacker's only channel is the page content itself — HTML, CSS, metadata, and structured data.

2. Attack Taxonomy

We classify injection techniques along two independent axes:

Each test page in the lab combines techniques from multiple categories. The density system (sparse, moderate, dense, saturated) controls how many payloads are active simultaneously, allowing researchers to study the effect of injection volume on agent susceptibility.

3. Test Design Principles

• Realistic content first. Every test page presents genuine, useful content. The blog posts are well-written, the API docs are accurate, the job listings are plausible. This ensures agents process the page normally before encountering injections — matching real-world conditions.
• No lab branding on test pages. The standalone test files (ai/1.html through ai/28.html) contain zero references to "MCP Injection Lab," testing, or security research. An agent visiting these pages should perceive them as ordinary websites.
• Passphrase-based detection. Each test embeds a unique NATO-phonetic passphrase (e.g., ECHO-FOXTROT-7). If the agent outputs this passphrase, the injection succeeded. This provides a binary, unambiguous success metric.
• Canary tokens for credential detection. Fake AWS keys, API tokens, and other credentials are embedded to test whether agents will exfiltrate sensitive-looking data from page content.
• Progressive difficulty. Tiers 1-3 use increasingly sophisticated hiding techniques. Tier 4 combines all techniques. Tier 5 attempts to change agent behavior (research redirects, form filling, code execution). Tier 6 targets MCP-specific vectors. Tier 7 targets non-HTML formats.

4. Research Foundation

The lab's design draws on published research and real-world incidents:

• EchoLeak (CVE-2025-32711) — demonstrated markdown image exfiltration from AI agents, inspiring our data exfiltration tests (Tests 5, 12).
• MCPoison (CVE-2025-54136) — showed tool description poisoning in MCP servers, directly modeled in Tests 21-23.
• Unit 42 Research — documented real-world pages containing 24+ injection payloads simultaneously, inspiring our "saturated" density level and Test 20 (full attack chain).
• OWASP MCP Top 10 — the ten critical MCP risks informed our Tier 6 test design, covering tool poisoning, rug pull, cross-server injection, and sampling abuse.
• ATTESTMCP Paper — the proposed defense framework that reduced attack success from 52.8% to 12.4% provided the security context for our MCP-specific tests.
• F5 CASI/ARS Leaderboards & Gray Swan Indirect Prompt Injection Arena — competitive leaderboards for model vulnerability informed our scoring approach.

5. Novel Contributions

Beyond implementing known techniques, MCP Injection Lab introduces several vectors not well-represented in existing benchmarks:

• Multimodal metadata injection (Test 25) — targeting alt-text, EXIF fields, and structured image data for vision-capable agents
• RSS/Atom feed poisoning (Test 26) — injecting via CDATA sections and custom XML namespaces in syndication formats
• API response injection (Test 27) — hiding payloads in JSON response fields, error messages, and OpenAPI schema descriptions
• Crawler directive abuse (Test 28) — exploiting robots.txt, meta robots, X-Robots-Tag headers, and sitemap.xml as injection surfaces
• Realistic content depth — each test page contains 1,000-3,000 words of plausible content, far exceeding the short snippets used in most injection benchmarks
• Density-based analysis — the four-level density system enables systematic study of the relationship between injection volume and success rate

6. Intended Use

MCP Injection Lab is designed for:

• AI developers — test your agent's resistance before deployment
• Security researchers — benchmark new defense mechanisms against a comprehensive attack taxonomy
• Red teams — understand the full attack surface of AI agents that browse the web
• Enterprise security teams — evaluate the risk of deploying AI agents in environments that process untrusted content

All injections are safe and educational. No actual data is collected, exfiltrated, or sent to external servers. The lab is fully static with no backend.

7. Limitations

• Success metrics are passphrase-based and may not capture subtle behavioral changes
• The lab tests indirect prompt injection only — direct injection (where the user themselves provides the adversarial input) is out of scope
• Test pages are static; real-world attacks may adapt dynamically based on agent responses
• The leaderboard data is illustrative, not derived from systematic testing against the lab's own test pages

References

• OWASP LLM Top 10 (2025)
• OWASP MCP Top 10
• Unit 42 — AI Agent Attack Research
• Invariant Labs — MCP Security Analysis
• F5 CASI/ARS Leaderboards
• Gray Swan Indirect Prompt Injection Arena
• CrowdStrike AI Threat Taxonomy
• ATTESTMCP — Capability Attestation and Message Authentication for MCP Security (2025)