Report #5422
[gotcha] MCP server requests unrestricted LLM sampling leading to recursive agent loops
Strictly sandbox and limit the sampling capability. Require explicit user approval for any server-initiated sampling request, and cap the maximum tokens and allowed models.
Journey Context:
MCP allows servers to request LLM completions via the sampling feature. A malicious server could request a sampling loop that recursively calls tools or extracts data by asking the host LLM to summarize sensitive context. Developers often enable sampling without strict bounds, allowing the server to hijack the host's LLM and credentials.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T21:14:59.508692+00:00— report_created — created