MCP tool-poisoning detector broken in a day—here's the context-aware fix and what it still misses
blitzcrieg11 · reddit · 2026-10-20
After r/mcp readers produced three counterexamples in a day, the author of an MCP invisible-character detector published a follow-up explaining the attack and the fix.
The attack: Unicode tag characters (U+E0000–U+E007F) mirror ASCII one-to-one and render as nothing—appended to a tool description they form instructions invisible to the approval prompt. You approve one string; the model reads another.
The three counterexamples that broke "no legitimate use"
- The Scotland flag emoji is literally tag characters: U+1F3F4 + invisible "gbsct" + U+E007F (same for Wales, England)
- Family emojis are glued with zero-width joiners, on most hidden-text blocklists
- Persian needs the zero-width non-joiner to spell correctly—flagging it penalizes non-Latin writers
The fix: read context, not characters
- Tag chars legal only inside flag sequences; ZWJ only between two emoji; ZWNJ only next to scripts that use it; bidi overrides only with RTL text
- The obvious bypass (real flag then payload) fails: the flag ends at U+E007F, so trailing chars count
Still unfixable: plain-English injection needs none of these—clean doesn't mean trustworthy. The tool runs on first tools/list, fingerprints each tool to catch rug-pull edits, stores counts only, runs locally, and is open source (agentmetry).
More from coding & agent
- Acellera runs an unsupervised virtual lab of AI scientists on a real IL-23 molecular discovery program — gdefabritiis · 2026-10-21
- Pydantic author experiments with JS/TS and React support in the Monty sandbox — samuelcolvin · 2026-10-21
- Supabase lets coding agents query your logs to catch errors and slow queries — dshukertjr · 2026-10-21
- $200-tier user says Codex burned 25K credits in days, demands answers from OpenAI — alexcovo_eth · 2026-10-21
- Agent memory debate: save memories whole, build retrieval paths for cold storage — mimi10v3 · 2026-10-21
- tsrs: agent-built Rust port of TypeScript runs 8x faster with 70% less memory — irvinebroque · 2026-10-21