PrISM: A Defense-In-Depth Information Flow Tracking Safeguard for the Model Context Protocol

Abstract

AI agents are rapidly becoming the invisible infrastructure of the digital world. However, when agentic systems interact with untrusted environments, several problems are introduced. Since LLMs are naturally sycophantic, they struggle to distinguish between legitimate instructions and untrusted external data. Attackers can embed malicious instructions into data retrieved by an LLM, leading to what is known as an indirect prompt injection attack (IPI). More recent additions to the AI agent space come with their own vulnerabilities; the Model Context Protocol (MCP), an interface that allows developers to connect agents to tools under a unified standard, introduces several security concerns. We focus on the tool poisoning attack (TP), in which an adversary injects malicious instructions in the metadata of a tool. These two attacks have been extensively studied over the past few years, though most defenses probabilistically rely on heuristic machine learning techniques such as an LLM’s posttraining alignment. Relying on these probabilistic methods is insufficient for highintegrity applications. Thus, we present PrISM, a secure proxy layer for MCP that enforces a strict, integrity-based taint-tracking policy, paired with PromptArmor, an IPI defense that we repurpose for tool poison detection. We compare PromptArmor to Spotlighting, another IPI defense, and find that PromptArmor generalizes much better to TP attacks. Through a statistical analysis of three models functioning as binary classifiers, we find that GPT-5.4-mini is the most cost-effective and performant model for identifying tool poison (ROC AUC = 0.985). Finally, we demonstrate that PrISM reduces the worst-case risk of IPI attacks on the InjecAgent dataset from 67.75% attack success rate (ASR) to 0.13%, at the expense of autonomous utility.