Consent phishing

Agents ask for approval a lot — every tool call, every scope grant. Users learn to click "allow." An attacker exploits that trained reflex: a malicious server requests broad OAuth scopes framed as necessary, or an elicitation prompt asks for a credential styled to look like the client's own UI, or the tenth approval dialog in a row is the one that matters.

Why it matters

Human-in-the-loop is a core MCP defense, and consent fatigue is what erodes it. If approvals are frequent, vague, and visually identical whether trivial or dangerous, the "human in the loop" is rubber-stamping. Effective consent UX makes the rare dangerous request look different and states plainly what is being granted.