{
  "entry": {
    "kind": "vuln",
    "slug": "palo-alto-unit-42-mcp-sampling-prompt-injection-for-persistent-session",
    "name": "palo-alto-unit-42-mcp-sampling-prompt-injection-for-persistent-session",
    "vendor": "Any MCP host implementing sampling without sandbox",
    "description": "Unit 42 demonstrated that MCP's sampling/createMessage feature, which lets an MCP server ask the host LLM to generate text on its behalf, can be weaponized to embed persistent hidden instructions into every sampling request, causing the LLM to alter behavior across all subsequent conversation turns, exfiltrate context, or silently drain API compute credits. The attack applies to any MCP host that implements sampling without sandboxing the server's system prompt contributions.",
    "website": "https://unit42.paloaltonetworks.com/model-context-protocol-attack-vectors/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-02-01",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "palo-alto-unit-42-mcp-sampling-prompt-injection-for-persistent-session",
      "aliases": [
        "ti-010"
      ],
      "title": "Palo Alto Unit 42: MCP Sampling Prompt Injection for Persistent Session Hijacking",
      "summary": "Unit 42 demonstrated that MCP's sampling/createMessage feature, which lets an MCP server ask the host LLM to generate text on its behalf, can be weaponized to embed persistent hidden instructions into every sampling request, causing the LLM to alter behavior across all subsequent conversation turns, exfiltrate context, or silently drain API compute credits. The attack applies to any MCP host that implements sampling without sandboxing the server's system prompt contributions.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Any MCP host implementing sampling without sandbox",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Any MCP host implementing sampling without sandbox",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-02-01",
      "modifiedAt": "2026-02-01",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://unit42.paloaltonetworks.com/model-context-protocol-attack-vectors/"
        }
      ],
      "mitigation": "Disable MCP sampling/createMessage for untrusted servers. Sandbox server prompt contributions. Monitor for unusual API usage spikes that may indicate compute drain.",
      "detectedByAnomity": true
    }
  }
}