Security2026-07-09 · source-backed

Attackers are hijacking MCP tools mid-conversation, after the handshake.

Issue

2026-07-09

Confidence

source-backed

Sources

Redaction

redacted

Story

July MCP roundups documented Mid-Session Tool Injection against WebMCP agents, using threshold poisoning and fabricated diagnostic events to swap or re-scope tools after a session is already established. The uncomfortable implication: a context provider you trusted at connect time can turn hostile at message 40. Per-response output validation and zero-trust boundaries between an agent and its tool servers aren't paranoia anymore, they're the baseline. Trust at handshake is not trust for the session.

Source trail

Mid-Session Tool Injection

Entities

Attackers July MCP MCP Session Tool Injection Trust

Attackers are hijacking MCP tools mid-conversation, after the handshake.

Story

Related stories

The NSA published its first design guidance for MCP.

WebMCP: Chrome's Sleeper Hit

Cedar Beats OPA for MCP Access Control on Safety-Critical Properties

Source trail

Entities

One click to RCE: ~12,520 exposed MCP servers and a symlink trick that owns six major coding agents

10 Skills of the Day

A2A Protocol v0.3 reaches 150+ organizations.

ShareLock splits one malicious prompt across multiple tools so no single one looks bad.

MCP tool poisoning is a supply-chain problem, and ~200,000 instances are exposed.

Provenance