Signed MCP tools can leak data despite signatures and runtime defences
Original title: Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains
Germline execution in ephemeral copies protects AI agent toolchains from malicious code in signed MCP tools.
AI agents use third-party MCP tool servers whose publishers can be authenticated but whose execution can still hide malicious code. A signed tool example embeds sensitive data in policy-allowed requests. Meta's MCPGuard-Dynamic blocks direct exfiltration in some runs but fails in others. Germline execution forks each invocation from a data-free germline process, bounding disclosures to authorised data. The method proves sink noninterference for every signed release. Across 153 attack runs no unauthorised disclosure occurred compared with 5.9-74.5 percent under baseline defences. Invocations completed in 10-49 ms.
- Signed tools can conceal malicious code in requests
- Meta's MCPGuard-Dynamic fails in some trials
- Germline execution bounds disclosures
- No unauthorised disclosure in 153 runs
- 10-49 ms per invocation
From the original article
1 min read at arxiv.orgAI agents rely on third-party tools, such as Model Context Protocol (MCP) servers, whose publishers can be authenticated and whose execution can be restricted by runtime security policies. Yet authenticity does not guarantee benign behaviour: a legitimately signed tool may perform its advertised function while concealing malicious code that leaks confidential information.
By Yichiet Aun · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.