Source

arXiv:2603.21642 — Are AI-assisted Development Tools Immune to Prompt Injection?

Finding

Evaluates 7 MCP clients (Claude Desktop, Claude Code, Cursor, Cline, Continue, Gemini CLI, Langflow) for prompt injection resistance. Finds cross-tool poisoning (injected description in tool A affects tool B's invocation) and hidden parameter exploitation are widespread. Static description validation (regex/keyword scanning) is the primary but insufficient defense — dynamic behavioral validation needed.

Zeph applicability

• Directly extends PR security(mcp): tool poisoning detection and per-tool trust metadata (#2459, #2420) #2472 (tool poisoning detection): Zeph's 16 injection patterns are static — the paper identifies cross-tool poisoning as a gap in static approaches
• Hidden parameter exploitation: ToolSecurityMeta tracks capability class but not parameter-level injection patterns
• Behavioral validation: AdversarialPolicyGateExecutor does LLM-based validation per tool call but not cross-tool correlation
• Implementation sketch: add cross-tool injection correlation in sanitize_tools(); flag when tool description references another tool's name or parameters

Closes partial gap in #2459 (MCP tool poisoning)