Allowed MCP tools can still hijack the next allowed call — the second-hop injection problem
Future_AGI · reddit · 2026-09-04
Future AGI lays out a narrow but critical MCP security gap: allowlists answer identity questions (which servers/tool names may run) but don't preserve authorization intent.
- The attack chain: an allowed read tool returns untrusted output, which then changes the arguments of the next allowed write tool. Every call matches the configured allowlist, yet prompt injection has crossed a boundary.
- Core proposal: the runtime needs a "second-hop decision" before dispatch — inspect output-derived arguments as arguments of the destination tool: were they formed from untrusted text? Do they request capabilities the user authorized? Do they fit the destination tool's expected scope?
- The blind spot: most agent guardrails only evaluate tool identity and miss this transition. Input-side checks need argument provenance — which values came from the prior tool result vs. the user or agent plan.
- The author describes their Apache-2.0 gateway's boundary checks (server/tool policy, arguments, textual results, per-tool limits) and opens the question of where the second-hop check belongs: runtime, MCP boundary, policy layer, or executor?
More from coding & agent
- Cohere Labs to host session on building voice agents for Asian languages — Cohere_Labs · 2026-09-04
- JetBrains deep dive: Go error handling techniques, best practices and common pitfalls — rseroter · 2026-09-04
- Agent training series finale: building agent environments with trl and openenv — SergioPaniego · 2026-09-04
- Open-source benchmark targets the tool layer: auth, retries, memory failures that agent evals miss — Kind-Atmosphere9655 · 2026-09-04
- Rust values vs places: the mental model that makes ownership click — Abhishekcur · 2026-09-04
- Claude Code on iOS is getting slash command support — testingcatalog · 2026-09-04