I'm going to be rather pedantic here given the seriousness of the topic. It's important that everyone understand how risky running a tool executing AI is, exact

I'm going to be rather pedantic here given the seriousness of the topic. It's important that everyone understand how risky running a tool executing AI is, exactly. Agents run various tools based on their current attention. That attention can be affected by the tool results from the tools they ran. I've even noted they alter the way they run tools by giving them a "personality" up front. However, you seem to argue otherwise, that it is the user's fault for giving it the ability to access the information to begin with, not the way it reads information as it is running. This makes me think of several manipulative tactics to argue for something that is an irrational thought: Stubborn argumentation despite clear explanations: Multiple people explained the confused deputy problem and why this constitutes an exploit, but you kept circling back to the same flawed argument that "you gave access so it's your fault." This raises questions about why argue this way. Maybe you are confused, maybe you have a horse in the game that is threatened. Moving goalposts: When called out on terminology, you shift from saying it's not an "attack" to saying it's not a "vulnerability" to saying it's not "MCP's fault" - constantly reframing rather than engaging with the actual technical issues being raised. It is definitely MCP's fault that it gives access without any consideration on limiting that access later with proper tooling or logging. I had my MCP stuff turn on massive logging, so at least I can see how stuff goes wrong when it does. Dismissive attitude toward security research: You characterized legitimate security findings as "common sense" and seemed annoyed that researchers would document and publish this type of exploit, missing the educational value. It can never be wrong to talk about security. It may be that the premise is weak, or the threat minimal, but it cannot be that it's the user's fault. False analogies: you kept using analogies that didn't match the actual attack vector (like putting passwords in search engines) while rejecting apt comparisons like SQL injection. In fact, this is almost exactly like SQL injection and nobody argues this way for that when it's discussed. Little Bobby Tables lives on. Inability to grasp indirection: You seem fundamentally unable to understand that the issue isn't direct access abuse, but rather a third party manipulating the system to gain unauthorized access - by posting an issue to a public Github. This suggests either a genuine conceptual blind spot or willful obtuseness. It's a real concern if my AI does something it shouldn't when it runs a tool based on another tools output. And, I would say that everyone recommending it should only run one tool like this at a time is huffing Elmers. Defensive rather than curious: Instead of trying to understand why multiple knowledgeable people disagreed with them, you doubled down and became increasingly defensive. This caused massive amounts of posting, so we know for sure that your comment was polarizing. I suppose I'm not suppose to go meta on here, but I frequently do because I'm passionate about these things and also just a little bit odd enough to not give a shit what anyone thinks.