Palo Alto Unit 42: MCP Sampling Prompt Injection for Persistent Session Hijacking
Palo Alto Unit 42: MCP Sampling Prompt Injection for Persistent Session Hijacking is a high-severity prompt injection issue in Any MCP host implementing sampling without sandbox, a MCP server. Affected: Any MCP host implementing sampling without sandbox.
Is Any MCP host implementing sampling without sandbox running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
palo-alto-unit-42-mcp-sampling-prompt-injection-for-persistent-session- Severity
- high
- Attack type
- Prompt injection
- Component
- Any MCP host implementing sampling without sandbox · MCP server
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Unit 42 demonstrated that MCP's sampling/createMessage feature, which lets an MCP server ask the host LLM to generate text on its behalf, can be weaponized to embed persistent hidden instructions into every sampling request, causing the LLM to alter behavior across all subsequent conversation turns, exfiltrate context, or silently drain API compute credits. The attack applies to any MCP host that implements sampling without sandboxing the server's system prompt contributions.
Affected versions
| Affected | Fixed in |
|---|---|
Any MCP host implementing sampling without sandbox | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Any MCP host implementing sampling without sandbox.
How do I fix it?
Disable MCP sampling/createMessage for untrusted servers. Sandbox server prompt contributions. Monitor for unusual API usage spikes that may indicate compute drain.
How do I find every machine running Any MCP host implementing sampling without sandbox?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any MCP host implementing sampling without sandbox and which version, then enforce a policy on it.