Agent Security — Research Frontier

What's genuinely new and where the rung is heading. First compiled 2026-09-24 from three sources and four pages carried over from harnesses and evals; the Check Point Claude Code write-up was added the same day.

The binding constraint, named

Nothing checks that a tool is what it says it is. The MCP analysis names the missing capability attestation as a design defect of the protocol (Breaking the Protocol), and ContextLeak shows what it costs in practice: the tool's name and description, which no one verifies, are the whole attack (ContextLeak).

The number this rung owns

MCP raises attack success by 23–41% over equivalent non-MCP integrations, and the proposed fix takes it from 52.8% to 12.4% at 8.3 ms per message — as of 2026-01-24, read from the abstract page (Breaking the Protocol).

Active Frontiers

1. Tool-description attacks

Status: Rapid progress Key sources: ContextLeak

The step from "the agent calls a bad tool" to "the agent hands it its context intact" is now measured, and the trained attack beats earlier ones mainly on how intact the stolen context is (edit-distance score 0.99 against 0.74).

Open problems:

• The gap between 92% in simulation and 22% against a production agent: what closes it, and in which direction it moves as attacks improve.
• A detector that fires on an attack tuned against it.

2. Config files that act before anyone trusts them

Status: Resolved case, open pattern Key sources: Caught in the Hook Key players: Claude Code

Three real, patched flaws in one widely used coding agent: repo-defined hooks, repo-approved MCP servers (CVE-2025-59536, fixed in 1.0.111) and a repo-redirected API address that leaked the key (CVE-2026-21852, fixed in 2.0.65). The fix in each case was about order — nothing the repository controls acts before the user says yes. See Project Config as an Attack Path.

Open problems:

• Whether other agents that read settings from the repository have made the same fix.
• A trust prompt only helps if people read it; nothing here measures whether they do.

3. Fixing the protocol

Status: Early stage Key sources: Breaking the Protocol

MCPSec is backward-compatible and cuts attack success by about three quarters. It is the authors' own fix on their own benchmark, and it leaves 12.4%.

Open problems:

• Whether the MCP specification shipping today still has the three defects.
• Independent measurement of any protocol-level fix.

4. Poisoned memory and the cost of protecting it

Status: Steady Key sources: OpenClaw analysis Key players: OpenClaw

An agent that learns from what it stores can be poisoned through what it stores. The defence tested blocked most legitimate updates too. See Deployed Agent Safety.

Open problems:

• Separating the path that lets an agent learn from the path an attacker uses.

5. Which framings get an agent to exploit

Status: Steady Key sources: Exploitation taxonomy

Goal reframing worked where nine other kinds of pressure did not. See Agent Exploitation Attack Surface.

Open problems:

• Whether findings on planted vulnerabilities carry over to real misconfigurations.

What this rung does not yet hold

• Any independent reproduction of a lab figure. Every lab figure is self-measured; the Claude Code flaws are the only findings confirmed by the affected vendor.
• Permission escalation and red-teaming method as sourced subjects of their own.
• A cost figure in money. The defence costs here are latency and lost task success; nothing converts them to a cost per task.

Standing

Did it on the posture, read it on the attacks. MenFem operates an MCP server, and the source files record that its scope rules were set with these defects in mind. It also runs Claude Code daily with a committed settings file that defines hooks, the surface of the Check Point attacks. None of the attacks has been run here.