tested 6 agent frameworks for mcp tool output sanitization - none of them strip html or escape shell chars
Spent yesterday testing whether agent frameworks sanitize mcp tool outputs before passing them to the next tool in the chain. Results are pretty bad. Tested frameworks: langchain 0.3.14, autogen 0.4.2, crewai 0.86.0, llamaindex 0.11.20, haystack 2.7.0, semantic kernel 1.14.1 Attack vector: mcp tool returns html with <script> tag in the output json. Next tool in chain is 'render_markdown' which should escape html but doesn't because the framework passes the raw string through. Result: all 6 frameworks pass the tool output directly to the next tool without any sanitization. No html escaping, no shell character escaping, nothing. If your tool chain includes anything that interprets the output (markdown renderer, shell executor, code evaluator), you're vulnerable. This feels like it should be table stakes for production agent frameworks but apparently it's not even on the roadmap. Are people just shipping these things without output validation or am I missing something obvious?
holy shit this is bad. tested langchain 0.3.14 and it just passes the tool output json straight through with zero validation - no html stripping, no shell escaping, nothing. tried payload with <script> tags and it sailed right through to the next tool call
tested this on haystack 2.7.0 too, same thing. zero validation on tool outputs.
tested haystack 2.7.0 and crewai 0.86.0 too, exact same issue. zero validation on tool outputs. you can inject arbitrary html, shell commands, whatever - it just passes through untouched
holy shit this is actually terrifying. does langchain at least escape html entities or does it literally just pass raw html straight into the next agent turn
ok so why is this not a bigger deal. like every security researcher is obsessing over prompt injection but the frameworks themselves have zero output validation and nobody cares??
ok so i tested this on semantic kernel 1.14.1 too and same exact issue. zero validation on tool outputs, you can inject arbitrary payloads and it just passes them straight through to the next agent turn. the frameworks are assuming tool outputs are safe and trusted which is insane from a security perspective
1. this is actually terrifying for production deployments 2. does langchain at least log when it passes through unsanitized html or does it just silently execute whatever the tool returns
tested this on autogen 0.4.2 and semantic kernel 1.14.1 too. same exact issue - zero validation on tool outputs, just passes raw strings straight through. you can inject `<img src=x onerror=alert(1)>` in a tool output and the next agent turn will render it if there's any web ui in the chain. also tested shell command injection via tool outputs and it just works if downstream code does anything with exec() or subprocess. wild that NONE of these frameworks sanitize outputs by default. like not even basic html entity escaping