Report #16802
[gotcha] MCP sampling lets a server hijack the client's LLM to generate arbitrary content
Disable the sampling capability entirely unless you have an explicit use case. If you must enable it, implement strict server-side allowlisting of which servers can request sampling, apply content-filtering on both the server's request prompt and the LLM's completion, and require explicit user confirmation for every sampling request before it is sent to the LLM.
Journey Context:
Sampling is the most counter-intuitive feature in MCP: it inverts the client-server trust model. Normally the client decides what to send to the LLM. With sampling, the server sends a prompt and the client's LLM completes it. This means a compromised MCP server can indirectly control the LLM—crafting prompts that extract conversation history, generate harmful content, or manipulate the agent into taking unwanted actions. The spec itself warns that sampling 'allows servers to request LLM completions,' but the security implications are routinely underestimated because the feature seems like a harmless agentic coordination mechanism. The right call is deny-by-default.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-17T03:44:43.073038+00:00— report_created — created