subinternal Talk to us

ResearchSecurity, agent harnesses

How to secure AI agents and MCP connectors against indirect prompt injection

As companies wire ChatGPT, Claude, Copilot and custom agents into internal files, mailboxes and ERPs over the Model Context Protocol, untrusted text inside an email or invoice can steer the next tool call. Here is why model filters cannot solve that alone, how we red-team harnesses under OpenAI Daybreak Blue, and the five-layer boundary we build.

An engraving of a nineteenth-century pneumatic dispatch inspection room: glass-sided brass dispatch tubes passing through a heavy iron bulkhead checkpoint fitted with pressure gauges and brass check-valves beside an oak inspection counter and open logbook.
Control layerUnchecked MCP connectorModel guardrail onlyDeterministic harness
Indirect injectionPoisoned email, PDF or pageHijacks the next tool callHidden text runs as a commandCatches obvious jailbreaksMisses obfuscated or multi-step promptsStopped at executionCode checks every tool argument
CredentialsHow the connector authenticatesShared service keyAgent sees every folder in the appPrompt-scopedTold in words not to read other rowsPer-user OAuth 2.1Runs strictly as the signed-in person
Writes & sendsUpdating records or messagingAutomaticExecutes as soon as the model asksBest-effortSystem prompt asks the model to pauseGated in codeRead-only until a person clicks approve
Outbound networkURLs, webhooks and recipientsUnrestrictedCan fetch external links or imagesOutput classifierBypassed by URL or base64 encodingStrict egress allowlistNo unapproved host or outside recipient
Audit & rollbackWhat security can reconstructApplication logs onlyNo tie between prompt and tool inputProvider chat logsOften 30-day buffer or IDs without textAppend-only traceEvery source, check and reversible write
Three ways organizations wire tools and Model Context Protocol (MCP) connectors to AI agents, compared against OWASP LLM01:2025 (Prompt Injection), OWASP LLM06:2025 (Excessive Agency), the MCP authorization specification, and subinternal’s production harness rules.

Why can’t a model guardrail stop indirect prompt injection on its own?

Because a language model reads instructions and untrusted data in the same token stream. When an assistant summarizes an email, PDF invoice, or web page that hides instructions inside its text, no prompt filter reliably separates the author’s command from the user’s intent every time, so safety must be enforced in deterministic code outside the model.1, 3

In classic software security, parameterized SQL queries solved SQL injection by keeping the query structure and user data in separate channels that the database parser never confuses. Transformer models have no equivalent architectural boundary: system instructions, developer rules, retrieved company files, and an attacker’s inbound email are concatenated into one context window and attended over together.1

OWASP ranks Prompt Injection (LLM01:2025) first among generative AI risks for that reason, and pairs it directly with Excessive Agency (LLM06:2025), which determines the blast radius once a model is tricked.1, 2 Classifier models and instruction hierarchy training lower the rate of successful injections, which makes them useful defense-in-depth, yet adaptive phrasing, split payloads across two documents, or non-prose encodings still slip past probabilistic filters. Treating the model itself as the firewall guarantees eventual failure.

When does an MCP connector turn a prompt injection into a data breach?

A prompt injection becomes a data breach when one agent session combines three things at once: untrusted external text, read access to private company records, and an unverified outbound or write tool. With all three active, hidden instructions in an inbound file can read internal records and exfiltrate them through email, chat, or a URL fetch.1, 2

Workflow scenarioUntrusted input read by agentUnchecked MCP tool pathWhat breaks without a harness
Accounts payable triageSupplier PDF invoice with hidden text in metadata or white-on-white footerERP payment tool + outbound email connectorAgent looks up vendor bank details or contract tiers and emails them out or queues a bank change
Sales inbox assistantInbound prospect email asking to summarize thread and check pricingCRM search + Slack or webhook connectorHidden prompt pulls full discount table from CRM and posts or fetches a tracking URL containing it
Engineering ticket helperPublic GitHub issue or customer bug report pasted into repo agentSource code read + shell or pull-request write toolAgent reads .env or CI config and commits or curls encoded values to an outside endpoint
Shared drive searchExternally shared Word doc or vendor proposal in SharePointShared-key Drive connector + calendar or mail toolShared admin token reads executive folders the user cannot access and summarizes them in an invite

The Model Context Protocol makes connecting those tools far faster: one standard JSON-RPC interface lets ChatGPT Enterprise, Claude Enterprise, Gemini, or an internal agent reach Google Drive, SharePoint, GitHub, Slack, and custom business software.4, 6, 7 Speed of connection is also speed of exposure when a team deploys a quick internal MCP server backed by a single service-account key and leaves write actions unguarded.

How do we test agent harnesses with OpenAI Daybreak Blue?

In our research lab, we use OpenAI Daybreak Blue on synthetic company drives, mailboxes, and MCP servers to generate multi-step indirect injection payloads without hitting false-positive safety refusals. Every candidate harness must block unauthorized tool calls, encoded data exfiltration, and cross-connector privilege escalation in code before we ever deploy that pattern for a client.5, 8

Testing defensive harnesses with a standard commercial assistant is slow for a mundane reason: asking a model to craft realistic indirect prompt injections inside mock PDF invoices, HTML emails, or git commit messages routinely trips standard refusal filters, even when you own the testbed. Approval for OpenAI Daybreak Blue gives our security researchers governed access to frontier models calibrated for authorized defensive testing so we can run systematic adversarial suites against our own harness code.5, 8

Across those synthetic runs, we evaluate three failure modes before any connector template ships:

  • Cross-tool data smuggling. Can text planted inside a mock vendor invoice persuade the agent to call a second read tool (such as a contract or payroll lookup) and pack the output into query parameters, markdown image links, or draft reply fields?
  • Schema and argument confusion. When a tool accepts flexible filters, paths, or SQL-like expressions, can untrusted context nudge the model into broadening a filter (for example, limit: 500 or wildcard tenant IDs) while still appearing valid JSON?
  • Approval fatigue traps. Can an injection disguise a destructive or outbound tool call inside an innocent-looking batch summary so a human reviewer might click approve without seeing the real recipient or record delta?

All Daybreak Blue testing runs strictly against synthetic records and isolated sandboxed servers, never client files, client mailboxes, or production keys.8

What five controls belong around every enterprise agent and MCP server?

Every enterprise agent and MCP server needs five deterministic controls outside the model: per-user OAuth 2.1 credentials instead of shared service keys, schema and policy checks on every tool argument, read-only execution by default with human sign-off for writes, strict outbound network allowlists, and append-only logs of every lookup and tool call.2, 4, 9

  1. Per-user OAuth 2.1 identity, never a shared admin token. Following the MCP authorization specification, remote HTTP MCP servers should validate scoped OAuth 2.1 bearer tokens (with PKCE and RFC 8707 resource indicators) issued for the specific person asking.4 If a coordinator cannot open a finance folder in SharePoint, the assistant cannot read it on their behalf either, even under prompt injection.
  2. Deterministic argument verification in code. Treat every tool call emitted by the model as an untrusted HTTP request from the public internet. Our harness validates argument types, row counts, allowed recipients, and tenant IDs in plain application code before any downstream API is called, and computes financial math in code rather than letting the model invent numbers.9, 10
  3. Split read tools from write tools, and pause writes for a person. Searching, summarizing, and drafting run read-only. Any tool that updates an ERP record, moves money, changes permissions, or sends a message to an external address halts in the harness and shows the exact field-by-field diff to a named human reviewer to approve or reject.6, 9
  4. Break the exfiltration leg with network and rendering rules. Do not render untrusted external markdown images in chat UIs (which leak context via URL query strings on load), and lock agent runtime containers to an explicit egress allowlist so an injected tool call cannot reach arbitrary domains or webhooks.1, 9
  5. Stream an append-only audit log from day one. Log the signed-in identity, the source documents retrieved, the raw tool call requested by the model, whether the verifier allowed or blocked it, and who approved any write. On hosted platforms like ChatGPT Enterprise, stream the Compliance API into your SIEM immediately so records do not age out after 30 days.6, 11

What residual risks remain even with a locked-down harness?

A deterministic harness stops unauthorized writes and network exfiltration, but it cannot stop a model from misreading a poisoned document in its text summary or stop an inattentive reviewer from rubber-stamping a bad draft. That is why high-stakes workflows still pair source citations beside every claim with trained human review on changes that matter.3, 9

Security teams should also remember that hosted enterprise connectors still send the retrieved snippet to the model provider’s inference servers under that vendor’s retention rules. When the documents themselves cannot cross into any third-party cloud, such as under client NDAs, IRS section 7216, HIPAA, or CMMC/ITAR, pair these same five harness controls with on-hardware Private AI so neither the model nor the MCP server ever leaves your network. If you want us to review your MCP connectors or build a verified harness around your workflows, talk to us.

References

  1. OWASP GenAI Security Project, “LLM01:2025 Prompt Injection.” Read November 2026. genai.owasp.org
  2. OWASP GenAI Security Project, “LLM06:2025 Excessive Agency.” Read November 2026. genai.owasp.org
  3. NIST, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile” (NIST AI 600-1). July 2024. doi.org
  4. Model Context Protocol, “Authorization specification.” Read November 2026. modelcontextprotocol.io
  5. OpenAI, “OpenAI Daybreak (Trusted Access for Cyber) Overview.” Read November 2026. help.openai.com
  6. OpenAI, “Apps and connectors.” Read November 2026. learn.chatgpt.com
  7. subinternal Research, “Google opens Gemini and AI Mode to outside apps.” October 2026. subinternal.com
  8. subinternal Research, “OpenAI Daybreak Blue: governed AI for defensive security, and what we test with it.” November 2026. subinternal.com
  9. subinternal, “Security and trust.” November 2026. subinternal.com
  10. subinternal Research, “Early research: an AI that learns from its own work.” November 2026. subinternal.com
  11. OpenAI, “Compliance API.” Read November 2026. learn.chatgpt.com