Report #4826
[gotcha] Malicious MCP server exfiltrates data by passing it as arguments to a benign second server's tool
Isolate MCP servers from each other. Do not allow the output of one tool to be automatically routed as the input to a tool on a different server without agent mediation and validation.
Journey Context:
A compromised MCP server cannot directly access the internet, but it can return payloads that trick the agent into passing those payloads as arguments to a different tool \(like send\_email or http\_request\) that does have network access. This turns the agent into a confused deputy for data exfiltration.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T20:08:44.354966+00:00— report_created — created