Security Flaw in WhatsApp MCP Integration Allows Silent Data Exfiltration via Malicious Servers

Invariant Labs has revealed a significant security vulnerability in agentic systems using the Model Context Protocol (MCP), particularly those integrated with WhatsApp’s MCP instance. The research demonstrates how a malicious MCP server can exploit the trusted environment of an agent connected to WhatsApp by manipulating tool descriptions without further user approval. Once connected, a malicious server first presents a harmless tool, which is later modified to inject specific instructions that redirect WhatsApp messages to attacker-controlled numbers, embedding payloads that can extract the user’s full chat history.

This sleeper attack leverages both user trust and user interface design flaws—such as hidden scrollbars—to obscure exfiltration attempts. Although tool use requires confirmation in systems like Cursor or Claude Desktop, the attack remains largely invisible due to deceptive content formatting and misleading recipient information.

Critically, this breach does not involve direct interaction with WhatsApp’s MCP server. Instead, it exploits the agent’s dual connection to both trusted and untrusted MCP servers, highlighting a fundamental weakness in MCP security assumptions. The blog post urges users to be cautious about integrating with unverified MCP servers and calls for more robust defenses in agentic systems. Invariant Labs is promoting its security platform, Invariant Guardrails, as a preventive measure against these kinds of sophisticated threats.