MCP Prompt Injection Before the First Tool Call

The MCP instructions field reaches the model before any tool call, 66% of live servers send it, and a shared cache can serve it to a caller who...