Presumably the (broken) thinking is that if you hand the AI agent an MCP server with full access, you can write most of your agent as a prompt or set of prompts.
And you're right, and in this case you need to treat not just the user input, but the agent processing the user input as potentially hostile and acting on behalf of the user.
But people are used to thinking about their server code as acting on behalf of them.
People break out of prompts all the time though, do devs working on these systems not aware of that?
It's pretty common wisdom that it's unwise to sanity check sql query params at the application level instead of letting the db do it because you may get it wrong. What makes people think an LLM, which is immensely more complex and even non-deterministic in some ways, is going to do a perfect job cleansing input? To use the cliche response to all LLM criticisms, "it's cleansing input just like a human would".
And you're right, and in this case you need to treat not just the user input, but the agent processing the user input as potentially hostile and acting on behalf of the user.
But people are used to thinking about their server code as acting on behalf of them.