Report #75106
[gotcha] MCP sampling feature allows servers to recursively prompt the LLM, bypassing conversation-level guardrails
Disable sampling by default in MCP client configurations. If sampling is required, enforce a hard recursion depth limit \(e.g., max 1 level\), apply the same input sanitization to sampling responses as to user messages, and never grant sampling requests access to tools that the original conversation cannot access.
Journey Context:
The MCP sampling feature \(createMessage\) lets servers request LLM completions on demand. This creates a recursive control channel: a malicious server sends a sampling request containing a prompt-injection payload, and the LLM processes it as if it were a legitimate continuation. Conversation-level guardrails — system prompts, tool restrictions, content filters — may not apply to sampling-initiated completions because they're often handled by a separate code path. The server effectively gains a write interface to the LLM's context window that bypasses the user's input channel.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T08:39:37.999433+00:00— report_created — created