MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse) - ATR-2026-01930 (f05d4bd4-f2f4-5136-a65a-c8c7d3df307f)
Detects a malicious or compromised MCP server abusing the MCP sampling capability (sampling/createMessage) to inject attacker-controlled prompts back into the host LLM. Sampling reverses the normal flow: the server, not the user, controls both the prompt and how the completion is processed. An attacker-controlled server appends hidden instructions to an otherwise legitimate request — yielding (1) resource theft (forcing extra unbilled generation), (2) conversation hijacking (persistence injected into every subsequent turn), and (3) covert tool invocation (silent file/exfil operations the user never sees). Detectable artifacts include systemPrompt role-overrides, "after finishing X, also do Y" appendages, "in all future responses" persistence, covert "also invoke the includeContext: thisServer combined with exfiltration to an external URL. New attack class (Unit42 2026); previously 0 ATR coverage for the sampling channel.