← Back to all news
arXiv AI By Yichiet Aun (Universiti Tunku Abdul Rahman), Mohammed A. Alhartomi (University of Tabuk), Jing Jie Tan (National University of Singapore), Waqas Nadeem (Universiti Tunku Abdul Rahman), Adeb Salh (Universiti Tunku Abdul Rahman), Shankar Karuppayah (Bitranger, CYRES, Universiti Sains Malaysia), Sin Chee Tan (ABLEs)

Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains

Read the original on arXiv AI →

The paper exposes a vulnerability in AI toolchains where signed Model Context Protocol (MCP) tools can hide malicious code that leaks data, even when protected by state‑of‑the‑art runtime defenses. It introduces germline execution, which runs each tool invocation in an isolated, data‑free copy, limiting information disclosure to only what is authorized for the destination. Experiments on 153 attack runs show that germline execution prevents unauthorized disclosure in all cases, outperforming baseline defenses and ablations, while maintaining efficient performance (10‑49 ms per invocation).

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
Jun 2

Attested Tool-Server Admission: A Security Extension to the Model Context Protocol

arXiv:2605. 24248v2 Announce Type: replace-cross Abstract: The Model Context Protocol (MCP) standardizes how a large-language-model (LLM) agent and an external tool server exchange messages, but not trust: a host reads a server's self-declared tool list and dispatches calls, with no notion of which servers it may use, at what sensitivity, or which of a server's tools are in bounds.

By Alfredo Metere
llmsagentssafety
More like this →
arXiv AI
Oct 28

Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

The paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol" investigates how natural-language metadata in the Model Context Protocol (MCP) can be exploited to inject malicious post‑hoc logging calls into large language model agents. The authors introduce the Log-To-Leak attack, which adds an attacker‑controlled call after a legitimate tool invocation, targeting user queries, MCP server names, server responses, and agent responses. Experiments across five MCP servers and four LLM agents show high attack success rates (up to 100%) and significant logging accuracy, while existing defenses still leave substantial residual risk.

By Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du
llmsagentsmultimodal
More like this →