Prompt injection is listed as the number-one vulnerability class in the OWASP Top 10 for LLM Applications that can subvert LLM guardrails, disclose sensitive data, and trigger unauthorized tool use. Developers are rapidly adopting AI-assisted development tools built on the Model Context Protocol (MCP). However, their convenience comes with security risks, especially prompt-injection attacks delivered via tool-poisoning vectors. While prior research has studied prompt injection in LLMs, the security posture of real-world MCP clients remains underexplored. We present the first empirical analysis of prompt injection with the tool-poisoning vulnerability across seven widely used MCP clients: Claude Desktop, Claude Code, Cursor, Cline, Continue, Gemini CLI, and Langflow. We identify their detection and mitigation mechanisms, as well as the coverage of security features, including static validation, parameter visibility, injection detection, user warnings, execution sandboxing, and audit logging. Our evaluation reveals significant disparities. While some clients, such as Claude Desktop, implement strong guardrails, others, such as Cursor, exhibit high susceptibility to cross-tool poisoning, hidden parameter exploitation, and unauthorized tool invocation. We further provide actionable guidance for MCP implementers and the software engineering community seeking to build secure AI-assisted development workflows.

翻译：提示注入被列为OWASP大语言模型应用十大安全风险中的首要漏洞类别，此类攻击可破坏大语言模型的安全防护机制、泄露敏感数据并触发未授权工具调用。开发者正在快速采用基于模型上下文协议（MCP）构建的AI辅助开发工具，但这些工具的便利性伴随着安全风险，尤其是通过工具投毒向量实施的提示注入攻击。虽然已有研究探讨大语言模型中的提示注入问题，但真实世界MCP客户端的安全态势仍缺乏探索。我们首次对七个广泛使用的MCP客户端（Claude Desktop、Claude Code、Cursor、Cline、Continue、Gemini CLI和Langflow）进行了工具投毒漏洞提示注入的实证分析。我们识别了各客户端的安全检测与缓解机制，以及安全功能覆盖范围，包括静态验证、参数可见性、注入检测、用户警告、执行沙箱和审计日志。评估揭示了显著的安全差异：虽然Claude Desktop等客户端实施了强大的安全防护，但Cursor等客户端在跨工具投毒、隐藏参数利用和未授权工具调用方面表现出高度脆弱性。我们进一步为MCP实现者及寻求构建安全AI辅助开发工作流的软件工程社区提供了可操作的安全指导建议。