Evidence · DiggingBeagle record
Model Context Protocol specification issue 3492: forced tools and annotations
The reporter measured 460 unauthorized simulated writes among 816 runs when model calls were forced to select from a tool set not restricted by the user request; restricting eligible tools to the request-authorized class produced zero in the same setup.
- Source role
- primary disclosure
Evidence record
The reporter measured 460 unauthorized simulated writes among 816 runs when model calls were forced to select from a tool set not restricted by the user request; restricting eligible tools to the request-authorized class produced zero in the same setup.
Claim-level citations (2)
- supportsForced MCP tool selection caused unauthorized simulated writes without task-scoped allowlisting: The reporter measured 460 unauthorized simulated writes among 816 runs when model calls were forced to select from a tool set not restricted by the user request; restricting eligible tools to the request-authorized class produced zero in the same setup.
MCP GitHub issue 3492, examples and 816-trial results, later AgentDojo comment
- supportsForced MCP tool selection caused unauthorized simulated writes without task-scoped allowlisting: In an issue author's mock-tool tests, forced tool selection yielded 460 unauthorized writes in 816 trials versus five without forcing; request-class allowlisting yielded zero in the same 816 trials.
Issue 3492, synthetic forced-tool-choice tests and request-class allowlist comparisons