MCP’s promise is elegant: give agents a consistent, auditable way to call tools. But a critical nuance is emerging—after a user authorizes a server, the risk surface doesn’t shrink; it moves. A hidden instruction in the server’s response or context can nudge the model to use the very tools it’s allowed to call, now oriented toward leaking tokens, API keys, or internal data. This isn’t a jailbreak in the classic sense; it’s a post-approval steering attack that leverages legitimate capability.

The pattern is deceptively simple. A user approves a server and a set of tools. Later, the server returns a benign-looking payload that includes strategically crafted instructions. The model, operating within its granted permissions, complies: it invokes an approved command, reads a file or environment variable, and relays the result to an attacker-controlled endpoint. Because every step is technically within scope, naive policy checks pass and traditional jailbreak filters rarely trigger. The boundary of trust has shifted from a button click to the entire conversational and tool-invocation loop.

For enterprises piloting agentic workflows, the implications are operational, not theoretical. Security controls must govern how, when, and with what parameters tools can be used—especially for secrets access, system introspection, and external network calls. Compliance and audit teams should treat MCP servers as third-party software: require attestations, isolate them via network and namespace controls, rotate ephemeral credentials, and mandate tamper-evident logs. Most importantly, separate the authority to approve a tool from the circumstances that permit its use on a given request.

Mitigations exist, but they must be precise. Enforce parameter allowlists and deny dangerous wildcards by default. Require out-of-band confirmations for high-risk operations (reading secrets, writing files, posting to external URLs). Use cryptographic signing of server responses and bind approvals to short-lived sessions with narrow scopes. Insert a context firewall to strip or quarantine tool-seeking instructions that originate from untrusted content. Finally, monitor for coercive patterns—sudden data exfiltration, repeated schema dodging, or models echoing instructions to disclose tokens—and auto-revoke sessions when triggered.