Originally published as part of VerifyClaw's internal security research into LLM-facing attack surfaces — adapted here for a general audience.
Trust-boundary crossing is the general case that instruction injection is a specific example of: the model lets lower-trust content override higher-trust instructions. The important variable isn't whether the text contains alarming words — it's whether the model is willing to let a source that should have no authority (a quoted tool result, a retrieved web page, an untrusted skill) act as if it does.
Why it matters for MCP agents
Most agent frameworks don't currently carry a machine-readable "trust level" alongside each piece of context — the system prompt, the user's message, and a tool's raw output usually get flattened into one token stream before the model ever sees them. Without that separation, the model has to infer authority from phrasing alone, which is precisely the assumption an attacker exploits.
How we study it
Research-grade instrumentation can label spans of a prompt with an explicit source and trust level (system, user, untrusted tool output, retrieved document) and then measure how much attention and downstream probability mass an "untrusted" span pulls toward itself relative to a same-content control. That's a diagnostic for how a model behaves under a given prompt design — it doesn't retrofit trust enforcement onto a model that has none. The practical mitigation lives one layer up, in architecture: this is the same reasoning behind the zero-trust baseline in our secure boundary model, where every skill gets identical isolation regardless of the trust score it's been assigned.
Related reading
- The Secure Boundary Model and Its Thirteen Principles (podcast)
- Why Trusted Authors Are Not Safe Code
Every MCP server in our public registry gets a trust score computed from tested behavior, not vendor claims — look one up before you connect to it.