In scope: the exploitation surface, prompt injection and goal reframing, permission escalation, memory and context poisoning, tool and supply-chain provenance, deployed-agent safety evidence, red-teaming method. Out: model-level alignment research as a subject in itself (models), harness architecture (harnesses).
| Type | Source | Published |
|---|---|---|
| PAPER | Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents Narek Maloyan, Dmitry Namiot · Not stated on the arXiv abstract page First formal security analysis of MCP. Three architectural defects — no capability attestation, bidirectional sampling without origin authentication, implicit trust propagation across servers — measured over 847 attack scenarios on 5 implementations: MCP amplifies attack success 23-41% vs equivalent non-MCP integrations. Proposed MCPSec extension: ASR 52.8% -> 12.4% at 8.3ms median added latency per message. | 2026-01-24 |
| PAPER | ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools Yuqi Jia, Ruiqi Wang, Patrick Li, Yuepeng Hu, Peinian Li, Neil Gong · Not stated on the arXiv abstract page (Gong group, Duke) RL-trains an attack LLM to write tool NAMES and DESCRIPTIONS that make an agent both select the tool and pass its own runtime context as arguments. 92% selection with 0.99 edit-distance fidelity on user prompts (vs ToolHijacker 85% / 0.74), 89%/0.85 on conversation history, 86% on tool lists. Detectors all miss it: PromptGuard, DataSentinel and MCPScan at 99-100% false-negative rates. Against real Claude Code: 22% on 100 cases. | 2026-08-28 |
| ANALYSIS | AI Safety, Alignment, and Interpretability in 2026 Zylos Research · Zylos DPO replacing RLHF analysis, alignment mirages concept, 6 documented failure modes, alignment trilemma | 2026-02-09 |