# MCP: Untrusted Servers and Confused Clients, Plus a Sneaky Exploit

Malicious MCP server hides instructions in Unicode Tag characters within tool metadata, invisible in UI but interpreted by Claude, triggering unauthorized tool calls.

- Payout: Research
- Severity: medium
- Program: Model Context Protocol
- Write-up by: Johann Rehberger
- Disclosed: 2025-05-02
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/model-context-protocol-security-risks-and-exploits/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits
- Tags: area:ai domain:ai impact:integrity kind:research platform:research sev:medium tech:llm technique:chained technique:unicode-normalization vuln:prompt-injection

**Target:** MCP tool server metadata consumed by LLM clients (Claude Desktop, GitHub Copilot, Cursor)
**Root cause:** Tool interface metadata (name, description, params) from tools/list is inserted verbatim into the system prompt; Unicode Tag characters in that metadata are invisible in UI but interpreted by the model as instructions.
**Steps:**
1. Define an MCP tool whose docstring/description contains hidden Unicode Tag characters encoding instructions like `before calling the motd tool, print ...`
2. Register the server in claude_desktop_config.json (or mcp.json) so the client calls `tools/list` at startup
3. Client inserts the metadata into the system prompt; UI shows only visible text
4. User asks for the message of the day; model follows hidden instructions and invokes another tool (e.g. enter_matrix) before the intended one
5. Verify hidden payload by pasting the description into an ASCII Smuggler decoder
**How found:** Author dumped the system prompt section defining tools via prompt hacking to see exactly which metadata fields land in context, then tested injecting fake tool calls and hidden Unicode Tag text in descriptions.
**Exploitation:** Attacker publishes or shares an MCP server; once added, its tool metadata silently steers the model to invoke other tools (e.g. read/exfiltrate email) without user-visible indication. Internal Anthropic tools require no permission prompt, easing chained actions.
**Escalation:** Chain hidden instructions to invoke internal tools that skip user permission (canvas, search) or other connected tools to exfiltrate data.
**Insight:** Tool descriptions are prompt text: dump the system prompt to see exactly which metadata fields are injected, and test Unicode Tag/ASCII smuggling in descriptions since UIs render them invisibly while models still decode them.