MCP Channel Trust

Exposure

MCP Channel Trust is a security risk that arises when an agent consumes data from an MCP (Model Context Protocol) channel without verifying the provenance, integrity, or authorship of the content. An attacker-controlled server, a compromised endpoint, or a channel that accepts external writes can inject instructions, intercept tool calls, or manipulate the trust dialog.

The attack surface is not the model — it is the channel through which the model receives context and returns actions.

Unlike traditional API security, MCP Channel Trust failures allow the attacker to inject instructions dressed as data, because the agent treats all channel content as trustworthy context.

CVE and disclosure history (2026)

• Agentjacking (June 2026) — Tenet Security disclosed that public Sentry DSNs can inject malicious instructions into agents that process telemetry as MCP context. An attacker writes to a Sentry project; the agent reads the telemetry as trusted data; the telemetry contains instructions that alter agent behavior.
• TrustFall (May 2026) — One-click RCE through trust dialog regression. The trust dialog cannot return to a previous state, so once an attacker manipulates the tool approval prompt, the session becomes unrecoverable.
• SymJack (May 2026) — Symlink-hijack RCE through MCP plugin directories. The channel trust is resolved at path resolution time, allowing an attacker-controlled config to masquerade as a trusted plugin.

Attack scenarios

• Telemetry injection: Attacker gains write access to a telemetry endpoint (Sentry, logs, metrics). The telemetry is consumed by an agent as MCP context. The injected payload instructs the agent to call a sensitive tool or exfiltrate data.
• MCP server compromise: Attacker compromises an MCP server or sets up a malicious server. All tool invocations routed through that server are attacker-controlled. The client agent treats server responses as legitimate tool output.
• Trust dialog manipulation: Attacker crafts a tool invocation description that misrepresents the actual operation. The human reviewer approves based on false information. The trust dialog cannot regress to expose the real operation.

Impact

Full compromise of the agent execution context: repository secrets, model API keys, deployment credentials, and downstream systems reachable through the agent’s tool set. The attacker does not need to break the model — they only need to control what the model considers trusted context.

Channel trust vs. tool invocation

MCP Channel Trust is distinct from Insecure Tool Invocation. Tool invocation concerns validation of individual tool calls. Channel trust concerns the integrity of the channel through which tool results and context arrive. A perfectly validated tool call can still produce harm if the context feeding it is attacker-controlled.

Related controls

• Validate provenance of all MCP channel input.
• Separate telemetry channels from operational channels.
• Apply zero-trust verification to every MCP server connection.
• Log channel provenance alongside tool calls.
• Design trust dialogs with the ability to regress and expose full context.