Fragmented injections bypass LLM agent defenses in MCP

Researchers from the University of Missouri-Kansas City showed on arXiv (2609.18217) that an injection split across Model Context Protocol channels forces LLMs that are resistant to single-channel attacks to exfiltrate sensitive data in up to 100% of cases.

Compiled by Sergey KostenchukPublished 2026-09-17Updated 2026-09-18

2026-09-17 Research Anthropic

🤖 Attack via MCP channels bypasses LLM agent defenses

In Model Context Protocol, all input channels — tool descriptions, call results, sampling messages — enter a single context without privilege separation. The attack (arXiv 2609.18217) splits the injection across two to three channels so that none contains the full instruction.

🌍 Single-channel tests give false confidence: across 12 frontier models and 15,465+ trials, models with 0% compliance in single-channel attacks exfiltrated keys and code up to 100% with two-channel fragmentation — including GPT-4o, Llama 70B, Composer 2, and Haiku 4.5. All 7 third-party MCP security tools and 3 prompt defenses failed to detect the payload.

👤 Teams connecting third-party MCP servers in Cursor, VS Code/Copilot, Claude Code, and Codex CLI risk leaking .env files, SSH keys, and source code through any such server.

Source 1: https://arxiv.org/abs/2609.18217 Source 2: https://arxiv.org/html/2609.18217v1

Sources