← Back to all news
arXiv AI By Zehua Zhang, Jie Hu, Pratham Hegde, Aditya Maheshbhai Gabani, Souradip Nath, Yibo Liu, Siyu Liu, Hongkai Chen, Hulin Wang, Zhuoer Lyu, Chang Zhu, Divij Handa, Yan Shoshitaishvili, Tiffany Bao, Ruoyu Wang, Adam Doupe

No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers

Read the original on arXiv AI →

The paper introduces no‑box vulnerability analysis, a method that detects security flaws without system access or runtime interaction by examining only the functionality metadata of a target. Using this approach, the authors built MCPSEC to audit Model Context Protocol servers for indirect prompt injection vulnerabilities, evaluating it on 20 servers with 177 tools. MCPSEC identified 143 vulnerable tools, achieving 98.9% recall of verified vulnerabilities, outperforming an LLM baseline.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
1d ago

Beyond Static Guarantees: Measuring the Static-Pass Dynamic-Fail Gap in Security-Sensitive and LLM-Generated Python Code

The paper introduces the Static‑Pass Dynamic‑Fail (SPDF) phenomenon, showing that static analysis can miss vulnerabilities that are exploitable at runtime. Using a three‑stage pipeline—static scanning, LLM‑driven CWE reasoning, and autonomous exploit verification—it evaluated 1,355 Python samples and found that 14.53% of samples that passed static checks were actually exploitable. The study highlights that static‑analysis success and runtime security are distinct assurance layers, especially for AI‑generated and security‑sensitive code.

By Jessica Pourleyli, Maitreyee Das Urmi, Glaucia Melo
llmsagentsreinforcement-learningsafety
More like this →
arXiv AI
Sep 4

Beyond Reproducibility: Towards Security-Aware Evaluation of Research Artifacts

The paper "Beyond Reproducibility: Towards Security-Aware Evaluation of Research Artifacts" examines 1,388 research artifacts from top security conferences, uncovering 132,431 candidate security findings through static analysis. It introduces a taxonomy for context-aware security assessment and presents SAFE, an autonomous framework that accurately distinguishes security-relevant findings and classifies risk types. The study demonstrates that nearly 45% of findings are security-relevant, highlighting the need for security-aware evaluation alongside traditional reproducibility checks.

By Nanda Rani, Christian Rossow
agents
More like this →
arXiv Machine Learning
Jun 18

OpenAnt: LLM-Powered Vulnerability Discovery Through Code Decomposition, Adversarial Verification, and Dynamic Testing

arXiv:2606. 19149v1 Announce Type: cross Abstract: Automated vulnerability discovery in large codebases remains challenging: traditional static analysis produces high false-positive rates, while dynamic approaches such as fuzzing require substantial infrastructure and often target narrow classes of bugs.

By Nahum Korda, Gadi Evron
llmssafety
More like this →