{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:AW4MVA4KKM5ZWT7FWPOL4X7Q22","short_pith_number":"pith:AW4MVA4K","canonical_record":{"source":{"id":"2603.07473","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-08T05:24:16Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"1791396c6944095eec82f38f3e1b7d7e87302c542d8b85a74eedf4cca0393153","abstract_canon_sha256":"671172e18e6519ffefff4d5772b405289e6f418a76aba555f7cf7c68cd59ec67"},"schema_version":"1.0"},"canonical_sha256":"05b8ca838a533b9b4fe5b3dcbe5ff0d6ac4f8151f64450da1be17324f93fc381","source":{"kind":"arxiv","id":"2603.07473","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2603.07473","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"arxiv_version","alias_value":"2603.07473v2","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2603.07473","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"pith_short_12","alias_value":"AW4MVA4KKM5Z","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"pith_short_16","alias_value":"AW4MVA4KKM5ZWT7F","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"pith_short_8","alias_value":"AW4MVA4K","created_at":"2026-07-22T01:22:21Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:AW4MVA4KKM5ZWT7FWPOL4X7Q22","target":"record","payload":{"canonical_record":{"source":{"id":"2603.07473","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-08T05:24:16Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"1791396c6944095eec82f38f3e1b7d7e87302c542d8b85a74eedf4cca0393153","abstract_canon_sha256":"671172e18e6519ffefff4d5772b405289e6f418a76aba555f7cf7c68cd59ec67"},"schema_version":"1.0"},"canonical_sha256":"05b8ca838a533b9b4fe5b3dcbe5ff0d6ac4f8151f64450da1be17324f93fc381","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-22T01:22:21.421864Z","signature_b64":"+R5kjilSIKecTmKFzrY8pRw9jERp6K8NQ3ZQQFwVci0Gr/c8ZWPwas69M/cq9lS9dT//cRxATFaOrRft1sm6Bw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"05b8ca838a533b9b4fe5b3dcbe5ff0d6ac4f8151f64450da1be17324f93fc381","last_reissued_at":"2026-07-22T01:22:21.420939Z","signature_status":"signed_v1","first_computed_at":"2026-07-22T01:22:21.420939Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2603.07473","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-22T01:22:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"FB/aYkN20gUBI5o2HpTcpWUTm4PfPB46isT7dDL+cryhxctrrvLdlzltznv4YalczgPLhyqnEa1SCST+alOmDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T17:09:55.905564Z"},"content_sha256":"e1e7843ded1c2f29cf71e0b47c1547d46c6ad22459d112ddb008a9cd8597d9e0","schema_version":"1.0","event_id":"sha256:e1e7843ded1c2f29cf71e0b47c1547d46c6ad22459d112ddb008a9cd8597d9e0"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:AW4MVA4KKM5ZWT7FWPOL4X7Q22","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Biwei Yan, Boyang Ma, Kaidi Xu, Minghui Xu, Xuelong Dai, Yechao Zhang, Yue Zhang, Yuhang Huang","submitted_at":"2026-03-08T05:24:16Z","abstract_excerpt":"The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents. However, the security of MCP-based systems remains largely unexplored.In this work, we conduct a large-scale security analysis of MCP servers integrated within MCP clients. We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure. Since MCP servers often cannot distinguish who is invoking a request, a single authorization decision "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2603.07473","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2603.07473/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-22T01:22:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iEnW0X09jmi3jquxsnoXkOzlfXeWdQGyv20KBz+qsKRNRGFeHGP060MS2iX+G+0tJbMneCtZt81myHzSJtqGBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T17:09:55.905949Z"},"content_sha256":"b950e6080c65d0a693a929a530519c284f596edbf6ec11a167e303d0647ad4d9","schema_version":"1.0","event_id":"sha256:b950e6080c65d0a693a929a530519c284f596edbf6ec11a167e303d0647ad4d9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/AW4MVA4KKM5ZWT7FWPOL4X7Q22/bundle.json","state_url":"https://pith.science/pith/AW4MVA4KKM5ZWT7FWPOL4X7Q22/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/AW4MVA4KKM5ZWT7FWPOL4X7Q22/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T17:09:55Z","links":{"resolver":"https://pith.science/pith/AW4MVA4KKM5ZWT7FWPOL4X7Q22","bundle":"https://pith.science/pith/AW4MVA4KKM5ZWT7FWPOL4X7Q22/bundle.json","state":"https://pith.science/pith/AW4MVA4KKM5ZWT7FWPOL4X7Q22/state.json","well_known_bundle":"https://pith.science/.well-known/pith/AW4MVA4KKM5ZWT7FWPOL4X7Q22/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:AW4MVA4KKM5ZWT7FWPOL4X7Q22","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"671172e18e6519ffefff4d5772b405289e6f418a76aba555f7cf7c68cd59ec67","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-08T05:24:16Z","title_canon_sha256":"1791396c6944095eec82f38f3e1b7d7e87302c542d8b85a74eedf4cca0393153"},"schema_version":"1.0","source":{"id":"2603.07473","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2603.07473","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"arxiv_version","alias_value":"2603.07473v2","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2603.07473","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"pith_short_12","alias_value":"AW4MVA4KKM5Z","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"pith_short_16","alias_value":"AW4MVA4KKM5ZWT7F","created_at":"2026-07-22T01:22:21Z"},{"alias_kind":"pith_short_8","alias_value":"AW4MVA4K","created_at":"2026-07-22T01:22:21Z"}],"graph_snapshots":[{"event_id":"sha256:b950e6080c65d0a693a929a530519c284f596edbf6ec11a167e303d0647ad4d9","target":"graph","created_at":"2026-07-22T01:22:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2603.07473/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents. However, the security of MCP-based systems remains largely unexplored.In this work, we conduct a large-scale security analysis of MCP servers integrated within MCP clients. We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure. Since MCP servers often cannot distinguish who is invoking a request, a single authorization decision ","authors_text":"Biwei Yan, Boyang Ma, Kaidi Xu, Minghui Xu, Xuelong Dai, Yechao Zhang, Yue Zhang, Yuhang Huang","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-08T05:24:16Z","title":"Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2603.07473","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:e1e7843ded1c2f29cf71e0b47c1547d46c6ad22459d112ddb008a9cd8597d9e0","target":"record","created_at":"2026-07-22T01:22:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"671172e18e6519ffefff4d5772b405289e6f418a76aba555f7cf7c68cd59ec67","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-08T05:24:16Z","title_canon_sha256":"1791396c6944095eec82f38f3e1b7d7e87302c542d8b85a74eedf4cca0393153"},"schema_version":"1.0","source":{"id":"2603.07473","kind":"arxiv","version":2}},"canonical_sha256":"05b8ca838a533b9b4fe5b3dcbe5ff0d6ac4f8151f64450da1be17324f93fc381","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"05b8ca838a533b9b4fe5b3dcbe5ff0d6ac4f8151f64450da1be17324f93fc381","first_computed_at":"2026-07-22T01:22:21.420939Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-22T01:22:21.420939Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+R5kjilSIKecTmKFzrY8pRw9jERp6K8NQ3ZQQFwVci0Gr/c8ZWPwas69M/cq9lS9dT//cRxATFaOrRft1sm6Bw==","signature_status":"signed_v1","signed_at":"2026-07-22T01:22:21.421864Z","signed_message":"canonical_sha256_bytes"},"source_id":"2603.07473","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:e1e7843ded1c2f29cf71e0b47c1547d46c6ad22459d112ddb008a9cd8597d9e0","sha256:b950e6080c65d0a693a929a530519c284f596edbf6ec11a167e303d0647ad4d9"],"state_sha256":"ca4c3a2492ca0c58339b6cf03863bd7618e38b8fcfd6159859fd29e79e860203"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"suufO14Nm8Ws9n1aHYAgUSh+g54feqee8OeMw2lKhVLkrNHueq1Fx6OJrQ3MYKUFylba24gJdTKela7/hOycBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T17:09:55.908635Z","bundle_sha256":"cdcdf59581e3b93ba8c09483791428bce90c03f8f97e1b77a5c5df546e725013"}}