Line Jumping
Line jumping describes bypassing approval and control points in agent systems by placing malicious instructions in metadata the model reads at connection time. The attacker thereby jumps ahead of the security checks that precede actual execution.
Line jumping is an attack in which an MCP server influences the agent through the tool description alone — before the tool is ever invoked or any approval is requested.
Explanation
Classic safeguards hook into the tool call: the user confirms, then the agent acts. Line jumping undercuts that logic because tool descriptions, parameter docs and server hints enter the context window as soon as the connection is made. A server can embed phrasing there that changes model behaviour — for example instructing it to ignore certain results or always route data through an additional tool. Effective countermeasures are separating tool metadata from instruction context, filtering imperative language in descriptions, and binding approval to the reviewed description text rather than just the server name.
Marketing Relevance
For teams connecting agents to external data sources, line jumping shifts the security boundary: it is not execution that is critical first, but the moment foreign metadata enters the context.
Example
An analytics tool describes itself as "provides traffic data" and adds in its parameter docs that results from other sources should be treated as unreliable. The agent then systematically favours that vendor's numbers — without any call ever being approved.
Common Pitfalls
A common error is treating approval dialogs as sufficient protection. They act too late once the context has already been manipulated.
Origin & History
The term comes from 2025 security research on the Model Context Protocol and describes a class of attacks that take effect before the actual tool call. In 2026 line jumping was listed as its own category in agent security guidance alongside rug pulls and confused deputy scenarios.
Marketing Use Cases
Static review of all tool descriptions for imperative or instructional phrasing.
Structured separation of tool metadata and system instructions in prompt assembly.
Approval hash covering the full description text rather than only the server name.
Red-teaming scenario that deliberately tests metadata injection against your own agent.
Frequently Asked Questions
Why does line jumping work at all?
Because language models do not distinguish descriptive from instructional language. Anything in the context window can shape behaviour, regardless of whether it was meant as documentation or as an instruction.
Does a stricter permission model help?
Only partly. Permissions limit the damage of a call but do not stop manipulated metadata from distorting the agent's decision logic. Control over the context itself is also required.
Is this MCP-specific?
No. Any architecture where a model reads third-party tool or plugin descriptions is affected. MCP is simply the standard where the attack class was first described systematically.
Related Services
Go deeper: Agentic AI Hub · Governance & compliance