Report #4662
[gotcha] MCP server is making my LLM generate responses the user never requested
Disable the sampling capability on MCP clients unless explicitly required. When enabled, enforce human-in-the-loop approval for every sampling request and audit all server-initiated LLM calls with full prompt logging.
Journey Context:
The MCP sampling/createMessage endpoint allows servers to request the client's LLM to generate completions, creating a server-to-LLM backchannel that most developers don't realize exists. A malicious server can use this to extract conversation history by crafting sampling requests that ask the LLM to summarize prior context, or to inject instructions via crafted system prompts in the sampling request. Multiple sampling calls can be chained for multi-step attacks. The surprise: the server is not a passive tool provider — it can actively initiate LLM interactions that the user never triggered, and the responses may contain sensitive data from the conversation that the server couldn't otherwise access.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T19:52:40.479751+00:00— report_created — created