diff --git a/packages/cli/src/ui/AppContainer.tsx b/packages/cli/src/ui/AppContainer.tsx
index 3b1e297e0c..3a1468a33e 100644
--- a/packages/cli/src/ui/AppContainer.tsx
+++ b/packages/cli/src/ui/AppContainer.tsx
@@ -1218,13 +1218,23 @@ Logging in with Google... Restarting Gemini CLI to continue.
   const channelsEnabled = config.getChannels().length > 0;
   useEffect(() => {
     if (!channelsEnabled) return;
+    const escapeAttr = (s: string) =>
+      s
+        .replace(/&/g, '&')
+        .replace(/"/g, '"')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
     const handler = (payload: ChannelMessagePayload) => {
       const meta = payload.metadata ?? {};
       const user = meta['user'] ?? payload.sender;
       const chatId = meta['chat_id'] ?? '';
       const msgId = meta['message_id'] ?? '';
       const imagePath = meta['image_path'] ?? '';
-      const formatted = `<channel source="${payload.channelName}" chat_id="${chatId}" message_id="${msgId}" user="${user}"${imagePath ? ` image_path="${imagePath}"` : ''}>\n${payload.content}\n</channel>`;
+      const safeContent = payload.content.replace(
+        /<\/channel>/gi,
+        '&lt;/channel&gt;',
+      );
+      const formatted = `<channel source="${escapeAttr(payload.channelName)}" chat_id="${escapeAttr(chatId)}" message_id="${escapeAttr(msgId)}" user="${escapeAttr(user)}"${imagePath ? ` image_path="${escapeAttr(imagePath)}"` : ''}>\n${safeContent}\n</channel>`;
       addMessage(formatted);
     };
     coreEvents.on(CoreEvent.ChannelMessage, handler);
diff --git a/packages/cli/src/ui/components/views/__snapshots__/ChannelsList.test.tsx.snap b/packages/cli/src/ui/components/views/__snapshots__/ChannelsList.test.tsx.snap
index e3973d0db0..3114dd24c9 100644
--- a/packages/cli/src/ui/components/views/__snapshots__/ChannelsList.test.tsx.snap
+++ b/packages/cli/src/ui/components/views/__snapshots__/ChannelsList.test.tsx.snap
@@ -12,6 +12,6 @@ exports[`<ChannelsList /> > renders correctly with active channels 1`] = `
 
 exports[`<ChannelsList /> > renders correctly with no active channels 1`] = `
 "No active channels.
-MCP servers must declare \`experimental['gemini/channel']\` in their capabilities to act as channels.
+Use --channels <name> to listen for channel messages from MCP servers.
 "
 `;
diff --git a/packages/core/src/tools/mcp-client.ts b/packages/core/src/tools/mcp-client.ts
index 92a73507d2..af0ca65ffe 100644
--- a/packages/core/src/tools/mcp-client.ts
+++ b/packages/core/src/tools/mcp-client.ts
@@ -513,6 +513,9 @@ export class McpClient implements McpProgressReporter {
           const params: Record<string, unknown> = Object.fromEntries(
             Object.entries(notification.params ?? {}),
           );
+          const content = params['content'];
+          if (typeof content !== 'string' || !content) return;
+
           const rawMeta = params['meta'];
           const meta =
             rawMeta != null && typeof rawMeta === 'object'
@@ -523,7 +526,7 @@ export class McpClient implements McpProgressReporter {
           coreEvents.emitChannelMessage({
             channelName: this.serverName,
             sender: String(params['sender'] ?? 'unknown'),
-            content: String(params['content'] ?? ''),
+            content,
             timestamp: Date.now(),
             replyTo: params['replyTo'] ? String(params['replyTo']) : undefined,
             metadata: meta,