HCP enforces eight execution-layer security invariants in MCP-style agent systems and blocks all ten benchmark attacks, unlike naive and mitigated connection-layer baselines.
arXiv preprint arXiv:2603.22489 , year =
5 Pith papers cite this work. Polarity classification is still indexing.
5
Pith papers citing it
fields
cs.CR 5years
2026 5representative citing papers
Unicode TAG-block encoding is the only of eight MCP tool-metadata attacks that is invisible in the approval view yet reaches the model verbatim, and re-approval is never forced even under rug-pulls.
Execution-security research for AI coding agents is fragmented across 17 mechanism categories with five unaddressed cross-cutting gaps, including missing head-to-head isolation-vs-capability evaluation and untested real-world denylist fragility.
The paper identifies twelve protocol-level security risks across MCP, A2A, Agora, and ANP and quantifies wrong-provider tool execution risk in MCP via a measurement-driven case study on multi-server composition.
CASCADE is a cascaded hybrid detector that combines fast regex/entropy filtering, BGE embeddings with local LLM fallback, and output pattern checks to achieve 95.85% precision and 6.06% false-positive rate against prompt injection and related attacks in MCP-based systems.
citing papers explorer
-
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
HCP enforces eight execution-layer security invariants in MCP-style agent systems and blocks all ten benchmark attacks, unlike naive and mitigated connection-layer baselines.
-
Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
Unicode TAG-block encoding is the only of eight MCP tool-metadata attacks that is invisible in the approval view yet reaches the model verbatim, and re-approval is never forced even under rug-pulls.
-
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
Execution-security research for AI coding agents is fragmented across 17 mechanism categories with five unaddressed cross-cutting gaps, including missing head-to-head isolation-vs-capability evaluation and untested real-world denylist fragility.
-
Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP
The paper identifies twelve protocol-level security risks across MCP, A2A, Agora, and ANP and quantifies wrong-provider tool execution risk in MCP via a measurement-driven case study on multi-server composition.
-
CASCADE: A Cascaded Hybrid Defense Architecture for Prompt Injection Detection in MCP-Based Systems
CASCADE is a cascaded hybrid detector that combines fast regex/entropy filtering, BGE embeddings with local LLM fallback, and output pattern checks to achieve 95.85% precision and 6.06% false-positive rate against prompt injection and related attacks in MCP-based systems.