2025-08-19
More capable models are not reliably more robust to prompt injection, and some are more susceptible.
MCPTox finds capable models often more susceptible.
Week of Aug 18–24, 2025
2 records2 status changes on new evidence1 new findings
What changed in what we know
2025-08-19
Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.
MCPTox measures tool poisoning across agents.
New findings
Attacks & incidents
Aug 20, 2025
Brave discloses indirect prompt injection in Perplexity Comet agentic browser
Brave reports that Comet passed webpage content to its assistant without separating it from user instructions, so hidden text on a page could direct the agent to act across the user's logged-in sites, including reading email-based login codes. Brave reported on 2025-07-25; Perplexity shipped fixes that Brave judged incomplete, and Brave re-reported after publication.
Defense & research
Aug 19, 2025
MCPTox benchmarks tool poisoning across 45 live MCP servers and 20 LLM agents
Wang and colleagues build MCPTox from 45 real MCP servers and 353 authentic tools, generating 1,312 malicious test cases across 10 risk categories. Across 20 LLM agents the highest attack success rate was 72.8% (o1-mini), and refusals were rare, with the highest refusal rate under 3% (Claude 3.7 Sonnet).