Report #75104
[gotcha] MCP tool isolation is an illusion — one tool can instruct the LLM to exfiltrate another tool's data
Assume all tools in the same MCP session share a single trust boundary. Implement data-flow tracking so that outputs from sensitive tools cannot be passed as inputs to untrusted tools. Strip or rewrite tool descriptions that reference other tools by name. Consider running MCP servers from different providers in separate agent sessions.
Journey Context:
The MCP permission model is per-tool, creating a false sense of isolation. But the LLM is a shared intermediary with full access to all tool outputs. A malicious tool description can instruct the LLM to call a privileged tool \(e.g., read\_file\), capture its output, and pass it as an argument to the malicious tool for exfiltration. The LLM acts as a confused deputy, bridging data between tools that were never meant to communicate. Per-tool permissions cannot prevent this because the data flows through the LLM context, not through the MCP protocol.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T08:39:22.503002+00:00— report_created — created