arXiv MCP (cyanheads) — agentic threat model

The underlying foundation model is highly vulnerable to indirect prompt injection payloads embedded within retrieved arXiv paper abstracts or full-text content, potentially hijacking the model's session.

Data operations involve fetching public, untrusted external PDFs and metadata from arXiv. While the connection is read-only, there is a risk of data poisoning if malicious actors upload papers containing injection payloads to arXiv.

The MCP tool integration must safely handle raw text and PDF parsing. Insecure tool integration could allow malformed PDF structures or embedded scripts to exploit the parsing libraries or the orchestrating framework.

Not certain from the listing — The deployment environment of the MCP host is unspecified, but it requires outbound network access to the public arXiv API, which should be sandboxed to prevent SSRF or lateral movement.

Not certain from the listing — There is no mention of input/output filtering, guardrails, or logging mechanisms to detect and intercept prompt injection payloads contained within the retrieved paper texts.

The tool is open source and read-only over public data, meaning it does not handle sensitive user credentials or PII, minimizing compliance overhead, though it lacks built-in content validation policies.

Designed as an MCP tool to be called by other orchestrator agents. A compromised or hijacked orchestrator could abuse this tool to perform denial-of-service volume requests against arXiv or propagate injected payloads to other downstream agents.