Yeah, I wrote about what is commonly injectable into the system prompt here: https://embracethered.com/blog/posts/2025/model-context-protocol-security-risks-an

Yeah, I wrote about what is commonly injectable into the system prompt here: https://embracethered.com/blog/posts/2025/model-context-protocol-security-risks-and-exploits/ https://embracethered.com/blog/posts/2025/model-context-prot... The short snippets are cool examples though. Similar problems exist also with other tool calling paradigms, like OpenAPI. Interestingly, many models interpret invisible Unicode Tags as instructions. So there can be hidden instructions not visible when humans review them. Personally, I think it would be interesting to explore what a MITM can do - there is some novel potential there. Like imagine an invalid certificate error or similar, but the client handles it badly and the name of the CA or attacker controlled info is processed by the AI. :)