How do I stop prompt injection hidden in fetched web pages or files from triggering MCP write tools?

What should I check, step by step?

1. Label every MCP tool by what it returns: trusted (your own config, values the user typed) or untrusted (web fetch, browser, file read, email, search results, any third-party server). Keep this list in the host or gateway, not in the tool description the server controls.

2. Taint on read: when an untrusted tool returns, mark the session as tainted, and where your runtime allows, mark the specific values (URLs, email addresses, amounts, file paths) that came from that result.
3. Write the plan before the read: declare the task's intended side effects (which write tools, which targets) while the context is still clean. After taint, allow only side effects that match the pre-declared plan; anything new needs a human.
4. Block tainted arguments to sinks: a recipient, URL, repo, amount or shell string that originated in fetched content must not flow into a send, pay, push or exec tool without approval — that is how hidden text exfiltrates data or redirects a payment.
5. Require approval with the exact call shown: tool name, full arguments, and which untrusted sources are in the context. Bind the yes to a hash of the arguments so the model cannot change them after the click.
6. Split roles where you can: a quarantined model or sub-agent summarizes untrusted pages into structured fields with no tool access; the planner that holds write tools never reads the raw page (dual-LLM / map-reduce patterns).
7. Keep detectors as signals, not gates: invisible-text and instruction-like scans on fetched content can raise the bar for approval, but a clean scan must never unlock a write on its own.
8. Record each taint event, blocked call and approval outside the agent so a reviewer can see what content was in context when a write was allowed.

Why can hidden instructions in a fetched web page or file trigger MCP write tools?

A model reads tool output as more context. White-on-white text in a web page, an HTML comment, a zero-width Unicode run in a file or an instruction in alt text can look like an instruction to the model even though no human sees it. OWASP lists this as indirect prompt injection (LLM01) and the resulting unchecked tool use as excessive agency (LLM06).

• The danger is the combination: untrusted content plus tools that change things or send data out. A read-only research agent that ingests a poisoned page produces a bad summary; the same agent with a send_email or git_push tool can be steered into acting.
• This is different from a malicious MCP server poisoning its own tool descriptions. Here every server can be honest — the attacker only needs to get text into a page or file your agent will fetch.

How do taint and provenance tracking stop untrusted content from choosing an agent's next action?

Session-level taint is the simple version: after the first untrusted read, every side-effecting call needs a match to the pre-declared plan or a human approval. It is coarse but cheap and catches most real attacks.

• Value-level provenance is the stronger version: CaMeL (Debenedetti et al., 2025) has a privileged model write the control flow from the trusted user query, lets a quarantined model parse untrusted data, and attaches capabilities to each value so a policy can refuse a tool call whose arguments came from untrusted sources. The authors report solving 77% of AgentDojo tasks with provable security versus 84% undefended — a real but bounded utility cost.
• The design-patterns paper (Beurer-Kellner et al., 2025) describes six patterns — action-selector, plan-then-execute, LLM map-reduce, dual LLM, code-then-execute and context minimization — that trade utility for isolation. Pick the strictest one your task tolerates; plan-then-execute alone still lets injected text alter the arguments of planned calls, so pair it with argument provenance checks.

How do declared intent and human approval stop prompt injection from triggering writes?

Declare the task's side effects while the context is clean: "create one draft PR in repo X" or "send the summary to the requesting user only". A later call that matches — same tool, same target — can proceed; a call to a new recipient, repo or domain cannot.

• When a write falls outside the declaration, pause and show the human the exact call plus the untrusted sources in context ("this session read https://example.com/page and report.pdf"). The approval binds to the argument hash and expires quickly.
• Do not reset taint by asking the model whether the content was safe. Clear it only by starting a fresh context that never saw the untrusted content, or by a human decision recorded outside the agent.