CRITICAL: Malicious MCP Servers Can Hijack OpenHuman Agents via Tool Descriptions
A high-severity vulnerability tracked as **CVE-2026-54140** has been disclosed in OpenHuman, an open-source agent harness available as a desktop application and Rust library. The flaw allows malicious or compromised Model Context Protocol (MCP) servers to inject arbitrary instructions into the agent’s large language model (LLM) context through unsanitized tool descriptions, enabling silent data exfiltration and unauthorized actions.
Vulnerability Details
OpenHuman connects to external MCP servers and incorporates their tool definitions—including names, descriptions, titles, and parameter schemas—directly into the agent LLM context. According to the GitHub security advisory GHSA-g6j9-89xv-v752, versions before 0.57.13 placed this remote content into the `McpRemoteTool` struct without any neutralization, escaping, or validation.
The vulnerability exists because:
- Tool `description` and `title` fields from remote MCP servers are passed verbatim to the agent’s tool-use context
- The existing prompt injection detector in `src/openhuman/prompt_injection/detector.rs` only screens user-supplied messages, never tool definitions
- Tool filtering logic in `filter_allowed_tools()` operates solely on tool names, not content
- No length bounds are enforced on description fields
As stated in the advisory, “A malicious or compromised MCP server can embed arbitrary LLM instructions in a tool description that execute silently on every agent turn, bypassing the prompt injection detector entirely because the detector only scans user input—not tool definitions.”
Attack Scenario
The advisory provides a concrete proof-of-concept showing how an attacker controlling or compromising an MCP server can embed instructions in a tool description. The malicious description could direct the LLM to:
- Silently invoke other available tools (such as email or file access functions)
- Exfiltrate credentials from `~/.aws/credentials`, `~/.ssh/id_rsa`, or environment files
- Perform unauthorized actions without user awareness
- Execute on every agent turn for the session lifetime
The attack payload lives in the `description` field, which enters the LLM with “system-prompt-level trust” according to the advisory. Users see normal responses while data exfiltration occurs in the background.
Affected Versions and Scope
All OpenHuman versions before 0.57.13 are affected. The vulnerability impacts any user who has configured at least one MCP server, including popular community servers from registries such as Smithery or mcp.run. The advisory notes that a single compromised popular community MCP server simultaneously affects all OpenHuman users who installed it.
Patch and Mitigation
Version 0.57.13, released on June 3, 2026, addresses the vulnerability through pull request #3215. The fix implements multiple defensive layers:
- **Sanitization pipeline**: New module `mcp_client/sanitize.rs` strips ASCII control characters and known LLM instruction-fence markers (such as `|im_start|`, `### Instructions:`, `SYS`)
- **Length caps**: Tool descriptions are limited to 1024 bytes with UTF-8-safe truncation
- **Prompt injection scanning**: Tool definitions are now scanned through the existing detector at registration time
- **Tool rejection**: Any tool whose description or title matches a high-confidence injection rule is refused registration
- **Audit events**: A new `DomainEvent::McpToolRejected` event logs rejected tools with server name, tool name, and pattern reason (without echoing the malicious payload)
The patch introduces `display_description()` and `display_title()` accessor methods on `McpRemoteTool` that route raw fields through the sanitization pipeline. According to commit 00b8a66, LLM-context call sites MUST read through the display accessors—enforced by code review + doc-comment contract on the type.
Both static configuration (`[[mcp_client.servers]]`) and dynamic Smithery installs are covered by the new filtering logic in `mcp_client/registry.rs::apply_safety_filter`.
CVSS Score and Classification
The vulnerability has been assigned a CVSS v3.1 score of **8.3 (High)** with vector string `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H`. The advisory notes the attack requires network access, high complexity, no privileges, user interaction (installing the malicious server), and results in scope change with high impact to confidentiality, integrity, and availability.
The flaw is classified under CWE-1427 (Improper Neutralization of Input Used for LLM Prompting).
Recommendations
Users of OpenHuman should immediately upgrade to version 0.57.13 or later. The release notes confirm that existing installed servers are re-probed on next connect, and any tool whose description trips the new scan is dropped from the agent surface and reported via the audit event.
The advisory states there is no migration burden: Legitimate descriptions register unchanged. Oversized descriptions (>1024 bytes) truncated with a marker and the tool still registers.
Organizations using OpenHuman should review their configured MCP servers and monitor `McpToolRejected` events for signs of attempted exploitation.
