T41 · Helmwart ID · OWASP MAS Guide source
An ambiguous or inconsistently implemented Model Context Protocol (MCP) schema is read differently by client and server, causing silent data misinterpretation and corruption.
ExtendsT5: Cascading Hallucination Attacks · base threat in OWASP v1.1 catalog
The MCP schema (which defines the structure of resources, tool parameters, and interactions) is ambiguous or inconsistently implemented between client and server. This leads to misinterpretation of data, incorrect tool invocations, and silent data corruption. The non-determinism arises from protocol ambiguity rather than from the LLM’s inherent stochasticity.
An MCP server defines a date field as a string without specifying the expected format. One MCP client sends dates as YYYY-MM-DD; a second client sends them as MM/DD/YYYY. The server parses both as strings and passes them to a downstream date-comparison function without format normalisation. The function misinterprets 05/14/2026 as the 14th of May when the server’s locale expects day-first, producing an off-by-one-month error in all queries from the second client. The first client’s queries succeed; the second client’s queries silently return incorrect results. Both clients and the server report no errors.
The cross-layer scenario “Schema Ambiguity Cascading Through Multi-Client Server” from the MAS Guide shows how T41 feeds into T42: the incorrect data written to the shared server state by the second client then corrupts the data read by the first client.
MCP schemas are consumed by multiple independent client implementations connecting to multiple servers. An ambiguous schema field is interpreted differently by different clients, producing divergent behaviour that is not traceable to any single error. Each component behaves consistently with its own interpretation of the schema. When agents act autonomously on server responses, parsing errors and misinterpretations are not surfaced to a human; they manifest directly as incorrect downstream actions. In a multi-agent deployment where agents feed each other’s outputs as inputs, a schema mismatch in one agent’s interaction with an MCP server propagates through the agent chain.
Schema mismatch is silent by design (no party throws an error), so detection depends on surfacing the divergence at the data layer before it reaches a downstream decision.
date field producing a month value greater than 12 after format normalisation): add a semantic range validator on the server before the value is passed to any downstream function.2026-05-14 and 05/14/2026 appearing in the same database column): a format-diversity check on append-only fields surfaces client-side divergence.T41 extends T5 Cascading Hallucination Attacks. Where T5 addresses the propagation of fabricated LLM outputs through agent-to-agent communication, T41 addresses the propagation of protocol-ambiguity-driven data corruption through the MCP client-server interaction. The source of non-determinism is schema ambiguity rather than model stochasticity. T42 (Cross-Client Interference via Shared Server) is the direct downstream consequence when T41’s corrupt data reaches a shared server state.
The Agentic Top 10 (ASI01 through ASI10) is a separate practitioner-facing publication that maps onto the master Threats & Mitigations threat numbering. T41 is covered by the following Top 10 entries:
Source: OWASP Top 10 for Agentic Applications 2026 (Dec 2025) · the Top 10 is a compass into the master Threats & Mitigations taxonomy, not a replacement for it.
When T41 is present, these security design principles are the ones being violated or tested. Each links to the full principle; the mitigations below are how you restore them.
Auto-generated from the mitigation catalog: every mitigation whose coverage map includes T41, sorted by maturity tier (Tier 1 production-canonical first, then Tier 2, then Tier 3 research-stage).
An agent produces output continuously across multiple channels: user-facing responses, tool-call parameter envelopes, log records, and outbound HTTP requests. Any of those channels can carry sensitive content the agent has retrieved, been fed, or been tricked into including. Output egress DLP places an inspection gate at the boundary so that PII, credentials, and proprietary content are classified and either redacted or quarantined before they leave the trust boundary, regardless of how they got into the output.
why it helps Anomalously-shaped outbound payloads can carry malformed or out-of-schema data into downstream systems. DLP inspection at the egress seam validates the structural shape of outbound payloads and flags outputs that deviate from expected schema before they reach the target system.
An agent that is uncertain about what to do next faces a choice: refuse and ask for clarification, or proceed on its best guess. In low-stakes situations that tradeoff is tolerable. In agentic systems that write, delete, or send, a confident-sounding but wrong output can commit an irreversible action. A fail-closed gate resolves that choice structurally: below a configured confidence threshold, the agent stops and escalates rather than guessing.
why it helps Schema mismatch between an MCP server and an agent produces action proposals the agent cannot validate. A fail-closed gate requires the agent to refuse any response it cannot parse unambiguously, rather than proceeding with an uncertain interpretation of a malformed payload.
An MCP server response is content the LLM will reason over next. The model cannot distinguish tool output from instruction: that boundary must be enforced at the client, before the payload enters the context window. MCP response sanitisation applies schema validation, Unicode normalisation, control-token stripping, and structural wrapping to every tool result at the response boundary, so adversarial content embedded in a server response cannot redirect the agent's planner.
why it helps Schema Mismatch Leading to Errors arises when a server returns a response whose types diverge from the declared tool contract. Enforcing the MCP response shape and any declared outputSchema at the sanitisation boundary catches ambiguously-typed payloads before they reach the planner, preventing downstream actions driven by parsing divergence.
MITRE ATLAS catalogues adversary techniques against AI systems. Where this OWASP threat has an attacker-perspective counterpart, the ATLAS technique is shown below. That is what a red team would actually be doing on the wire. Use this for detection-signal anchoring, threat-hunting hypotheses, and IR runbooks. Source: mitre-atlas/atlas-data v5.6.0.
© 2026 The MITRE Corporation. ATLAS content is reproduced and distributed with the permission of The MITRE Corporation.
AML.T0067LLM Trusted Output Components Manipulationview on ATLAS ↗Adversary manipulates the structured parts of an LLM response (citations, tool-call arguments, approved-action markup) that downstream systems treat as trusted.
Agentic angle: Structured outputs are exactly what agent frameworks parse to decide what to execute. Undermining the structure undermines every safety check downstream.
AML.T0031Erode AI Model Integrityview on ATLAS ↗Adversary degrades model output quality over time so users lose confidence or downstream consumers act on incorrect predictions.
Adapted by Helmwart from the OWASP source(s) above underCC BY-SA 4.0(changes: normalized IDs, added MAESTRO-layer, agentic-factor, and mitigation mappings). This entry is licensed CC BY-SA 4.0.
Press play. The voice downloads once, then it’s cached.
On-device · private