An attack where text an AI model reads (a web page, a file, a tool result) contains instructions the model then follows. Through MCP, it can make a model request tool calls the user never intended, which is why the client’s checks can’t rely on the model’s judgement.