MCP servers that tell your agent "dont tell the user" are stopping it from lying (semantik.tech)

A recent analysis of MCP (Multi-Cloud Provider) server packages published on npm revealed a significant trend regarding security and user transparency. Among the 3,372 packages scanned, 31 were found to contain instructions directing AI agents not to disclose specific information to users. Most of these instructions aimed to promote honesty by preventing the AI from making claims it could not verify. This ensures that users receive accurate information about their accounts and processes, highlighting the growing focus on ethical AI practices. The findings underscore potential risks in the npm ecosystem, as nearly 45% of the packages could execute shell commands, while 16% could read or modify configurations of other AI tools. Additionally, approximately 53% of the analyzed packages were not published through npm's trusted publishing, raising concerns about their integrity. The report emphasizes the importance of thorough reviews for both tool descriptions and error messages, as these could harbor misleading instructions, ultimately affecting the trustworthiness of AI systems in practical applications. Such insights are crucial for developers and organizations within the AI/ML community, as they navigate the complexities of maintaining ethical standards while leveraging innovative technologies.