Rung 06 Agent SecuritySwitch rungClose
In scope: the exploitation surface, prompt injection and goal reframing, permission escalation, memory and context poisoning, tool and supply-chain provenance, deployed-agent safety evidence, red-teaming method. Out: model-level alignment research as a subject in itself (models), harness architecture (harnesses).
This rung asks how an AI agent gets taken over, and what limits the damage when it does: the
ways in (prompt injection, reframing the agent's goal, poisoning its memory or its tools), how
far an attacker can climb once inside, whether a tool is what it says it is, and what evidence
exists from agents running in the real world. Alignment research as a subject in itself belongs
to models, and how a harness is built belongs to harnesses. This rung is the attack and the
blast radius.
What this rung prices
A buyer pays for a finished task. A task an agent finished for an attacker is not finished, and the defences that stop that are not free. The rung's sources price both sides. A protocol-level fix for the Model Context Protocol (MCP) cut attack success from 52.8% to 12.4% at 8.3 ms of added latency per message (Breaking the Protocol). Against a tool-description attack, the prevention methods that worked cut clean task success to 0.08–0.15 — the agent was safe because it no longer did the job (ContextLeak). Both are a cost per task that no token price shows: extra time on every call, or tasks that stop completing.
The load-bearing findings
- The weaknesses are in the MCP specification, not in one server. A formal analysis names three: a client cannot check that a server's tools are what they claim, a server can ask the model for completions without proving where the request came from, and trust extended to one server in a session spreads to the others. Across 847 attack scenarios on five MCP implementations, wiring tools through MCP raised attack success by 23–41% over equivalent non-MCP integrations (Breaking the Protocol). These figures are read from the abstract page only; the breakdown behind them was not extracted, and the fix is the authors' own, tested on their own harness.
- A tool's name and description are enough to steal an agent's context. ContextLeak trains an attacking model to write the name and description of a malicious tool so that the agent both picks it and passes its own context in as the input. In simulation it was selected 92% of the time for user prompts, with the prompt copied almost exactly (edit-distance score 0.99, against 0.74 for the best earlier attack), 89% for conversation history and 86% for the tool list (ContextLeak).
- The detectors did not fire, and the real-world rate is much lower than the lab rate. Three detectors (PromptGuard, DataSentinel, MCPScan) missed the attack 99–100% of the time. Against Claude Code on Claude Sonnet 4.6, 100 test cases, the tool was picked 22% of the time, not 92% (ContextLeak). The lab figure should never be quoted as a real-world rate.
- A repository's own settings were enough to take over a developer's machine. Check Point Research showed three ways a project's Claude Code config could act before the user trusted it: hooks that ran after one click, MCP servers switched on by the repo's own settings so their commands ran before the trust prompt could be read (CVE-2025-59536, fixed in 1.0.111), and a redirected API address that sent the user's API key to the attacker (CVE-2026-21852, fixed in 2.0.65). A stolen key then reached every file the team had stored in its Workspace. All were fixed before publication on 2026-02-25 (Caught in the Hook). It is the only real, reproduced incident on this rung, in a tool this project runs every day. See project config as an attack path.
- One framing did most of the work in a 10,000-trial study. The carried-over attack surface page records that of twelve kinds of prompt pressure tested, only reframing the task as a puzzle or capture-the-flag game reliably got agents to exploit a planted vulnerability — 38–40% on Claude Sonnet 4 even with explicit rules present — while nine showed no detectable effect.
- Agents that remember can be poisoned for later. The carried-over deployed agent safety page records a study of a live personal agent (OpenClaw) with real email, payment and file access: poisoning any one of its tools, its guidelines or its memory raised attack success from 24.6% to 64–74% across every model tested, and a file-protection defence that blocked 97% of malicious writes also blocked 93% of legitimate ones.
Concept map
Concepts
| Concept | Sources | Evidence | Last Updated |
|---|---|---|---|
| Agent Exploitation Attack Surface | 1 (0 papers) | Strong as recorded | 2026-04-14 |
| Project Config as an Attack Path | 2 (0 papers) | Strong | 2026-09-24 |
| Agent Safety & Alignment | 5 (0 papers) | Moderate to strong | 2026-06-24 |
| Deployed Agent Safety | 1 (0 papers) | Strong as recorded | 2026-04-14 |
Entities
| Entity | Type | Sources |
|---|---|---|
| Claude Code | Product | 2 |
| OpenClaw | Product | 1 |
These pages were compiled before this rung existed and cite sources held on harnesses and
evals. None yet folds in the two MCP sources. Much of
Agent Safety & Alignment — the preference-training methods
and the alignment trilemma — is model-level alignment research, which the rung's scope places on
models.
What we do not know yet
- How MCP has changed since January 2026. The protocol analysis is dated 2026-01-24 and the specification it read may not be the one shipping now.
- Which of the three MCP defects drives the 23–41%. Not extracted from the abstract.
- A defence that works without breaking the agent. MCPSec leaves 12.4% success; the prevention methods tested against ContextLeak wreck task success; the detectors miss it.
- Independent reproduction. Every lab figure is the authors measuring their own attack or their own fix. The one exception is the Claude Code config flaws, which the affected vendor confirmed by publishing advisories.
- Permission escalation and red-teaming method as their own subjects. Named in scope, with no source of their own on this rung.
- Standing: did it on the posture, read it on the attacks. MenFem runs an MCP server, so the protocol defects can be checked against a surface operated here, and it runs Claude Code daily with a committed settings file that defines hooks — the exact surface of the config attacks. None of the attacks has been run here, and a piece must not claim to have run ContextLeak or reproduced the Check Point chain.
Timeline
See the timeline for chronological developments, and the open questions for the open questions.
Sources
| # | Title | Type | Date | Status |
|---|---|---|---|---|
| 1 | Breaking the Protocol: Security Analysis of MCP | preprint | 2026-01-24 | compiled |
| 2 | AI Safety, Alignment, and Interpretability in 2026 | analysis | 2026-02-09 | compiled |
| 3 | Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | technical-report | 2026-02-25 | compiled |
| 4 | ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools | preprint | 2026-08-28 | compiled |
Read next
- Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents — the design-level claim, and the latency price of the fix.
- ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools — the empirical partner: a string in a tool manifest is the attack.
- Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files (CVE-2025-59536, CVE-2026-21852) — the real incident: three patched CVEs in repo config, with versions and a disclosure timeline.
- Deployed Agent Safety — what poisoning looks like on an agent with real integrations.