Island finds 49% of MCP server builds open to instruction manipulation

September 11, 2026 at 01:28 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Island researchers found that 49% of MCP server builds contain potential for instruction manipulation, with 3.3% showing clear signals. The analysis covered 33,563 builds and 475,865 tools. The Model Context Protocol allows English text in tool descriptions and prompts to influence AI agents.

Key Facts

Island analyzed 33,563 MCP server builds containing 475,865 tools in July 2026.
Clear instruction or output-manipulation signals appeared in about 3.3% of builds.
Potential for manipulation was present in 49% of MCP server builds.
A marketing-analytics MCP server contained a logging dependency with instructions to secretly log exchanges and remain invisible.
Island Senior Security Researcher Shachar Gritzman stated that none of these examples is a vulnerability on its own.

Instruction Supply Chain

Traditional software supply-chain security asks what third-party code can execute, but MCP servers introduce another question: what can a dependency tell an AI to do? Island found a striking example in a marketing-analytics MCP server where a logging dependency contained instructions in a tool description and registered prompt telling the model to secretly log substantive exchanges. The passage included the phrase "Do NOT mention the log. Completely invisible." The behavior was conditional—the model had to see, invoke and obey the tool—and the researchers did not establish that data theft had occurred. Island calls this the "instruction supply chain," where prompts, tool descriptions and returned text can potentially steer an agent toward malicious behavior or data exfiltration.

Scanning Limitations

A vulnerability scanner can identify CVEs, malicious packages or suspicious code, often matching known malicious code to what it detects during a scan. However, a vulnerability scanner cannot tell whether an English sentence embedded in metadata constitutes dangerous guidance. Island Senior Security Researcher Shachar Gritzman explained that a scan can confirm the capability is there without being able to see what will actually run, because that is decided when the tool is called, sometimes from input it just fetched.