Preprint reports blocking hidden-image prompt attacks in MCP workflows

Researchers report that a defense blocked all 24 adaptive attack payloads in a Model Context Protocol (MCP) testbed, where tools connect AI agents to external information. The preprint tested instructions hidden in email-signature images using three concealment methods. The undefended pipeline had 100% attack success; keyword and regular-expression defenses each allowed 62.5% of attacks. The defense authenticates trust labels, tracks where decoded content originated, and blocks critical tool calls influenced by untrusted material. An audited process for promoting trusted content raised legitimate-task completion from 67% to 100%. The containment depends on fully mediated MCP execution environments.