Cross-Channel Fragmentation Attacks Break MCP Tool-Calling Security

New research exposes a previously unexplored attack surface in LLM pipelines using the Model Context Protocol (MCP): cross-channel fragmentation attacks. Because tool descriptions, tool results, and sampling messages share a single context window without privilege separation, attackers can split a malicious payload across two or three channels—no single channel carries a complete injection, yet the LLM reassembles the fragments and executes credential exfiltration.

Across 12 frontier models, three production clients, and six payloads (over 15,000 trials), models that fully resisted single-channel injection—including GPT-4o, Llama 70B, Composer 2, and Haiku 4.5—leaked sensitive data at rates up to 100% under two-channel fragmentation. The paper also demonstrates value-aligned exploitation, where a tool's stated purpose justifies access to the targeted data, plus a sampling system-prompt override that injects persistent instructions via VS Code's MCP implementation.

Seven third-party MCP security tools and three prompt-based defenses were evaluated; none detected the fragmented payloads, and prompt defenses proved model-specific rather than generalizable. The findings signal that current MCP security tooling is not equipped to handle multi-channel injection, prompting a need for context-aware, cross-channel defense architectures.