Approved, Not Shown: the consent surface nobody verifies
Three gates now stand between an agent and a dangerous action. Signing proves the artifact came from who it claims — and doesn’t make its contents safe. Attestation proves the agent is permitted to act — and says nothing about when the artifact last changed. The third gate is a human clicking Approve, and it is the one no protocol verifies at all.
August made that concrete six times over. Two deeplink flaws installed an attacker-controlled MCP server and ran unsandboxed commands after a single click, because the install dialog truncated the approved command off the edge of the screen. A malicious repository combined symlinks with a prompt that displayed one path while the agent wrote to another — reproduced across six coding assistants, after Adversa AI had already reported the same shape in five. CVE-2025-59536 sidestepped the question entirely: a Hook injected into a repository’s settings file executed before the trust dialog rendered. Hidden one-pixel text on a web page rewrote an agent’s own MCP config. A plain-English payload in a public GitHub issue became an instruction the agent obeyed.
Filed separately, these are six vendor bugs with six patches. Read together, they are one measurable quantity. Call it the consent delta: the set of actions an approval authorizes, minus the set of actions that approval displayed. Every one of the six is a case of Δ > 0, and only the mechanism differs — the string is truncated, the target is substituted, or the execution pre-empts the dialog altogether.
That framing matters because it moves the defect out of the UI layer. A truncated command is not a CSS problem; it is an authorization boundary whose contents were never bound to the credential it produced. HCAP can prove an agent held the capability. ABFP can flag the deviation afterwards. Neither can tell you that the operator authorized something other than what they read — because nothing in MCP, A2A, or any agent framework attests the rendered surface at all.
The full research defines the delta, separates the three mechanisms, walks what mas-sentry-toolkit can and cannot observe from outside the render context, and proposes an attested render digest as the missing primitive.