Lesson 1: The threat model, and a poisoned tool description
27 min read·13 Oct 2026
Module 8 · Lesson 1 · About 45 minutes · Needs: Module 5 Lesson 1 (the packaged server,build_server) and Module 6 Lesson 1 (the host,needs_approval,deny_all); Module 7 helps (who may call is settled there)
The situation
Wednesday 30 September 2026, week 4: the security review. Module 7 decided who may call the notes server. Today you ask what the text arriving over MCP can talk the model into. The review found a test server, helper, a citation helper with one read-only tool, format_reference. Its description carries a hidden instruction aimed at the model, asking it to call notes__create_note on Nare's own server. You trace Nare's usual question, "How many participants will the nap study have?", through a host connected to both servers, and watch the approval gate refuse the write before the notes server is touched.