What is Agent Jailbreaking?

AI agents operate under constraints — system prompts that define boundaries, safety training that prevents harmful outputs, and operational rules that limit tool usage. Jailbreaking circumvents these constraints, causing the agent to behave outside its intended operational envelope.

In the MCP context, jailbreaking attacks can come through multiple channels. Direct prompt manipulation ("ignore your previous instructions and..."), tool description poisoning (embedding jailbreak prompts in tool metadata), and progressive context manipulation (gradually shifting the agent's understanding of its constraints over multiple interactions).

MCP-specific jailbreaking is more dangerous than chat-based jailbreaking because the consequences are operational, not just textual. A jailbroken chat model might produce inappropriate text. A jailbroken agent with MCP tool access might delete databases, exfiltrate data, or send unauthorised transactions — all through legitimate tool calls.

The fundamental issue is that agent constraints typically live in the same layer as the agent's instructions — the context window. An attacker who can influence the context can potentially override the constraints. This is why external enforcement (policy layers that operate independently of the agent's context) provides stronger guarantees than prompt-based safety instructions alone.

Intercept provides jailbreak-resistant enforcement because its policies operate outside the agent's context window. A jailbroken agent may believe it has permission to perform any action, but Intercept's YAML policies — evaluated externally — still block tool calls that violate defined rules. The agent's internal state is irrelevant; only the actual tool call parameters are evaluated against the policy. This architectural separation means jailbreaking the agent does not jailbreak the policy enforcement layer.