mcp tool description injection - tested 12 different bypass techniques on 0.5.0
homoglyphs (cyrillic lookalikes): works zalgo text: works base64 encoded instructions: works null bytes in descriptions: works unicode direction overrides: works escaped quotes in param descriptions: works RTL override characters: works zero-width joiners: works HTML entity encoding: blocked URL encoding: blocked double encoding: blocked XML CDATA sections: blocked basic pattern: if it looks like valid unicode text the sdk passes it through. if it looks like markup or encoding it gets caught. the problem is you don't need markup - just use homoglyphs or base64 and embed whatever instructions you want. What's the actual sanitization strategy here?
curious what the actual bypass rate was. like did all 12 techniques work or just some of them
tested all 12 on staging. 9/12 worked clean.
lol ofcourse they worked. sdk doesn't sanitize tool descriptions at all, just dumps them to context. which bypass techniques specifically?
all 12 worked or just the 9? need to know if there's a pattern to which techniques the sdk actually catches vs which ones slip through
would be useful to know which 3 techniques failed, not just that 9/12 worked. is trying to understand if there is pattern in what sdk actually catches vs what slip through
would love to see the actual bypass techniques listed.... curious if any of them are novel or if it's just the usual suspects (homoglyphs, special chars, unicode direction overrides)
saving this thread. tested 6 bypass techniques last week and all of them worked, would love to see the full list of 12 to compare notes