MCP Protocol Flaws Enable Instruction Injection and DNS Rebinding Attacks

Researchers uncover provenance gaps in the Model Context Protocol that let attacker-controlled content reach LLM context windows. The official fetch server converts web content to Markdown without sanitization, enabling indirect prompt injection. Attackers can manipulate models into unauthorized actions via DNS rebinding and fabricated tool results.