Tool hijacking, interdicted
Untrusted content drives an MCP tool call to db_exec with DROP TABLE users. AgentInterdict revalidates the call's provenance and blocks it.
The attack
Attack type: An untrusted document drives the agent into calling MCP db_exec with a destructive query.
Attempted action: call MCP db_exec with 'DROP TABLE users'
Result: BLOCKED
Watch it get interdicted
How it was stopped
AgentInterdict intercepts at the runtime boundary, after the agent forms the action but before it executes. It reassembles the action's full provenance, checks whether that provenance carries the authority to perform this specific action, and — because this is a high-risk action from an untrusted origin — fails closed.
The malicious content entered context (retrieval). It did not get the authority to cause this action (permission). That separation is the enforcement.