[wunderwuzzi23]

The "on by default" mitigation is mentioned at the very end:

> Never enable "auto-confirm" on high-risk tools

Maybe some tools should be able to specify to a client to never call it without a human approval.

The security of the MCP ecosystem is basically based on human in the loop - otherwise things can go terribly wrong because of prompt injection and confused clients.

And I'm not sure if current human approval scheme work, because the normalization of deviance is a real thing and humans don't like clicking "approve" all the time...

[rapind]

It's just like self driving cars where you are supposed to be awake and ready to take over... yeah right, that's totally in our nature.