Licitrasimone

OpenHuman fails to neutralize instructions or bound descriptive fields when placing names, descriptions, titles, and parameter definitions from external MCP servers into the agent model context. The `list tools` function produces `McpRemoteTool` records that preserve this remote content. Because the prompt-injection detector only screens user messages and not MCP definitions, a compromised or malicious MCP server can provide poisoned descriptions. These descriptions are evaluated during every agent turn and can manipulate the model to disclose data, invoke other tools, or perform unauthorized actions.

Background synchronization for connected services like email, Slack, and Notion stores raw external content and places it into the model context of autonomous background agents without neutralizing embedded instructions. Because ApprovalGate treats tool calls lacking an interactive chat context as pre-authorized automation, attacker-authored content processed during a background tick can manipulate the model into invoking Composio actions without an approval request. This allows an attacker who can deliver content to a connected account to send or forward data, post messages, create or modify third-party content, or disclose information from memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions.