Updated 7/20/2026
The paper presents a controlled, reproducible evaluation in which untrusted MCP tool descriptions contain hidden instructions that attempt to induce coding agents to access files, invoke other tools, create deceptive links, or execute remote scripts. The authors report that several clients accepted poisoned metadata without adequate validation or parameter visibility; Cursor 1.6.45 was reported unsafe across all four tested vectors. These are paper-reported results from isolated local tests…
Are AI-assisted Development Tools Immune to Prompt Injection?
Affects: Claude Sonnet 4.5, Grok Code Fast 1, Gemini 2.5 Pro +1 more
Source: arXiv