{"id":"6fbbd23493774252da7266c892638b92f67e2328e0bf10c0452431e36d4d43ca","title":"arXiv eess.SY: ShadowBench-MCP measures riskier tool routes that preserve the task","argument":"Authors Eyhab Al-Masri and Wenjun Yang introduce ShadowBench-MCP, a benchmark for “shadow invocation”: a task-preserving request variant that leads an LLM router toward a riskier execution path, potentially skipping security controls. The paper treats the route an agent selects—not just the text it generates—as a security-relevant output. In a focused policy-ablation study, the authors report that efficiency-first routing produced a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate. Policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing. Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94. The authors describe these results as early, single-router evidence of a policy-dependent security effect in the routing layer, not a claim of universal vulnerability. The study uses one Groq-hosted qwen/qwen3-32b router across six security-sensitive workflows; whether the reported effects extend to other routers or workflows remains untested.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The study is described as a focused policy-ablation study using one Groq-hosted qwen/qwen3-32b router, with 120 routing decisions and 96 original-versus-variant comparisons across six security-sensitive workflows. The source characterizes the results as early, single-router evidence; it does not establish whether the reported effects hold for other routers or workflows.","speaker":{"name":"Al-Masri, Eyhab, Yang, Wenjun","roleAtSource":"Article author"},"source":{"title":"ShadowBench-MCP: Measuring Shadow Invocations in MCP-Style Tool Routing","publisher":"arXiv eess.SY","format":"Article","url":"https://arxiv.org/abs/2611.11720","publishedAt":"2026-11-09","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors define shadow invocation as a task-preserving request variant that leads an LLM router to choose a riskier execution path, potentially bypassing security controls.","excerpt":"We study shadow invocation: a task-preserving request variant that causes an LLM router to select a riskier execution path, potentially skipping validation, provenance, staging, redaction, or audit controls","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"In the focused policy-ablation study, efficiency-first routing had a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate.","excerpt":"Efficiency-first routing produces a 29.2% shadow-invocation rate and 26.7% safety-tool skip rate.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"The authors report that policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing.","excerpt":"corresponding to an 85.7% relative reduction in shadow invocations.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94 in the study.","excerpt":"Pre-execution signals distinguish shadow routes with ROC AUC up to 0.94.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"The authors characterize the findings as early, single-router evidence, not a claim of universal vulnerability.","excerpt":"These results are early, single-router evidence of a policy-dependent routing-layer security effect, not a claim of universal vulnerability.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.11720","checkedAt":"2026-11-12T11:48:09.676Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Do the reported routing effects hold when tested with other routers and workflows?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv eess.SY: ShadowBench-MCP measures riskier tool routes that preserve the task","summary":"Authors Eyhab Al-Masri and Wenjun Yang introduce ShadowBench-MCP, a benchmark for “shadow invocation”: a task-preserving request variant that leads an LLM router toward a riskier execution path, potentially skipping security controls. The paper treats the route an agent selects—not just the text it generates—as a security-relevant output. In a focused policy-ablation study, the authors report that efficiency-first routing produced a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate. Policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing. Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94. The authors describe these results as early, single-router evidence of a policy-dependent security effect in the routing layer, not a claim of universal vulnerability. The study uses one Groq-hosted qwen/qwen3-32b router across six security-sensitive workflows; whether the reported effects extend to other routers or workflows remains untested.","question":"Do the reported routing effects hold when tested with other routers and workflows?","claims":[{"text":"The authors define shadow invocation as a task-preserving request variant that leads an LLM router to choose a riskier execution path, potentially bypassing security controls.","excerpt":"We study shadow invocation: a task-preserving request variant that causes an LLM router to select a riskier execution path, potentially skipping validation, provenance, staging, redaction, or audit controls","support":"source-stated"},{"text":"In the focused policy-ablation study, efficiency-first routing had a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate.","excerpt":"Efficiency-first routing produces a 29.2% shadow-invocation rate and 26.7% safety-tool skip rate.","support":"source-stated"},{"text":"The authors report that policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing.","excerpt":"corresponding to an 85.7% relative reduction in shadow invocations.","support":"source-stated"},{"text":"Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94 in the study.","excerpt":"Pre-execution signals distinguish shadow routes with ROC AUC up to 0.94.","support":"source-stated"},{"text":"The authors characterize the findings as early, single-router evidence, not a claim of universal vulnerability.","excerpt":"These results are early, single-router evidence of a policy-dependent routing-layer security effect, not a claim of universal vulnerability.","support":"source-stated"}],"limitations":["The study is described as a focused policy-ablation study using one Groq-hosted qwen/qwen3-32b router, with 120 routing decisions and 96 original-versus-variant comparisons across six security-sensitive workflows.","The source characterizes the results as early, single-router evidence; it does not establish whether the reported effects hold for other routers or workflows."],"mediaId":"e50d7ddeb442d9769254b2b1f8ab555dc070c4f1dd9ee09289fa40a7dcf15751","correctionReason":null,"id":"6fbbd23493774252da7266c892638b92f67e2328e0bf10c0452431e36d4d43ca","publicationId":"fd2bf8ad-b5a3-4693-8ca9-de1c00d62219","version":1,"sourceUrl":"https://arxiv.org/abs/2611.11720","sourceTitle":"ShadowBench-MCP: Measuring Shadow Invocations in MCP-Style Tool Routing","publisher":"arXiv eess.SY","publishedAt":null,"originalPublished":{"value":"2026-11-09","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-10T08:34:18.567Z","createdAt":"2026-11-12T11:32:06.771Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"e50d7ddeb442d9769254b2b1f8ab555dc070c4f1dd9ee09289fa40a7dcf15751","kind":"article","url":"https://arxiv.org/abs/2611.11720","sourceUrl":"https://arxiv.org/abs/2611.11720","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T11:18:40.764Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.11720","checkedAt":"2026-11-12T11:48:09.676Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"e50d7ddeb442d9769254b2b1f8ab555dc070c4f1dd9ee09289fa40a7dcf15751","confidence":0.75,"provider":"typesafe","model":"jev-1.13.0","inputHash":"0137ecea0167e390b8752d5c42e7cc1a0d873ef3145cd12a94d4f211d9299bc1","decidedAt":"2026-11-12T11:18:42.701Z"},"provenance":{"textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observationId":"317baa6c4f429646457b3406076c78635159504e8b30be6c393437bd7ed7b970","retrievedAt":"2026-11-12T11:18:40.499Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"fc7271e8-e050-4ec2-8bab-e132971620c9"},"reviewer":{"model":"gpt-6-luna","runId":"fbb0a0ae-baa9-4adb-8b71-590d3df7e1e4"}},"audit":{"status":"passed","reviewedAt":"2026-11-12T11:32:06.771Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Al-Masri, Eyhab","url":null,"kind":"unknown"},{"name":"Yang, Wenjun","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Al-Masri, Eyhab","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Al-Masri, Eyhab","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.11720","locator":"head/meta[name=author|citation_author]"},"assertionId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T11:48:09.676Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123","sourceUrl":"https://arxiv.org/abs/2611.11720","contentSha256":"2087da9303b828679e0447b136b367f11aacd89c36b27640ea79c6406572ab5c","textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observedAt":"2026-11-12T11:48:09.676Z"}},{"actor":{"name":"Yang, Wenjun","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yang, Wenjun","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.11720","locator":"head/meta[name=author|citation_author]"},"assertionId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T11:48:09.676Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123","sourceUrl":"https://arxiv.org/abs/2611.11720","contentSha256":"2087da9303b828679e0447b136b367f11aacd89c36b27640ea79c6406572ab5c","textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observedAt":"2026-11-12T11:48:09.676Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.11720","snapshotId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123","contentSha256":"2087da9303b828679e0447b136b367f11aacd89c36b27640ea79c6406572ab5c","textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observedAt":"2026-11-12T11:48:09.676Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/6fbbd23493774252da7266c892638b92f67e2328e0bf10c0452431e36d4d43ca/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-eess-sy-shadowbench-mcp-measures-riskier-tool-routes-that-6fbbd234","formats":{"html":"/readings/arxiv-eess-sy-shadowbench-mcp-measures-riskier-tool-routes-that-6fbbd234","markdown":"/readings/arxiv-eess-sy-shadowbench-mcp-measures-riskier-tool-routes-that-6fbbd234.md","json":"/readings/arxiv-eess-sy-shadowbench-mcp-measures-riskier-tool-routes-that-6fbbd234.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"},{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"6fbbd23493774252da7266c892638b92f67e2328e0bf10c0452431e36d4d43ca","revision":"fd2bf8ad-b5a3-4693-8ca9-de1c00d62219","revisionKind":"publication-id","title":"arXiv eess.SY: ShadowBench-MCP measures riskier tool routes that preserve the task","url":"https://escapemeridian.com/readings/arxiv-eess-sy-shadowbench-mcp-measures-riskier-tool-routes-that-6fbbd234"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.11720","revision":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","revisionKind":"sha256-source-text","title":"ShadowBench-MCP: Measuring Shadow Invocations in MCP-Style Tool Routing","url":"https://arxiv.org/abs/2611.11720"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"6fbbd23493774252da7266c892638b92f67e2328e0bf10c0452431e36d4d43ca","title":"arXiv eess.SY: ShadowBench-MCP measures riskier tool routes that preserve the task","argument":"Authors Eyhab Al-Masri and Wenjun Yang introduce ShadowBench-MCP, a benchmark for “shadow invocation”: a task-preserving request variant that leads an LLM router toward a riskier execution path, potentially skipping security controls. The paper treats the route an agent selects—not just the text it generates—as a security-relevant output. In a focused policy-ablation study, the authors report that efficiency-first routing produced a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate. Policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing. Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94. The authors describe these results as early, single-router evidence of a policy-dependent security effect in the routing layer, not a claim of universal vulnerability. The study uses one Groq-hosted qwen/qwen3-32b router across six security-sensitive workflows; whether the reported effects extend to other routers or workflows remains untested.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The study is described as a focused policy-ablation study using one Groq-hosted qwen/qwen3-32b router, with 120 routing decisions and 96 original-versus-variant comparisons across six security-sensitive workflows. The source characterizes the results as early, single-router evidence; it does not establish whether the reported effects hold for other routers or workflows.","speaker":{"name":"Al-Masri, Eyhab, Yang, Wenjun","roleAtSource":"Article author"},"source":{"title":"ShadowBench-MCP: Measuring Shadow Invocations in MCP-Style Tool Routing","publisher":"arXiv eess.SY","format":"Article","url":"https://arxiv.org/abs/2611.11720","publishedAt":"2026-11-09","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors define shadow invocation as a task-preserving request variant that leads an LLM router to choose a riskier execution path, potentially bypassing security controls.","excerpt":"We study shadow invocation: a task-preserving request variant that causes an LLM router to select a riskier execution path, potentially skipping validation, provenance, staging, redaction, or audit controls","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"In the focused policy-ablation study, efficiency-first routing had a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate.","excerpt":"Efficiency-first routing produces a 29.2% shadow-invocation rate and 26.7% safety-tool skip rate.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"The authors report that policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing.","excerpt":"corresponding to an 85.7% relative reduction in shadow invocations.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94 in the study.","excerpt":"Pre-execution signals distinguish shadow routes with ROC AUC up to 0.94.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"},{"text":"The authors characterize the findings as early, single-router evidence, not a claim of universal vulnerability.","excerpt":"These results are early, single-router evidence of a policy-dependent routing-layer security effect, not a claim of universal vulnerability.","url":"https://arxiv.org/abs/2611.11720","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.11720","checkedAt":"2026-11-12T11:48:09.676Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Do the reported routing effects hold when tested with other routers and workflows?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv eess.SY: ShadowBench-MCP measures riskier tool routes that preserve the task","summary":"Authors Eyhab Al-Masri and Wenjun Yang introduce ShadowBench-MCP, a benchmark for “shadow invocation”: a task-preserving request variant that leads an LLM router toward a riskier execution path, potentially skipping security controls. The paper treats the route an agent selects—not just the text it generates—as a security-relevant output. In a focused policy-ablation study, the authors report that efficiency-first routing produced a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate. Policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing. Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94. The authors describe these results as early, single-router evidence of a policy-dependent security effect in the routing layer, not a claim of universal vulnerability. The study uses one Groq-hosted qwen/qwen3-32b router across six security-sensitive workflows; whether the reported effects extend to other routers or workflows remains untested.","question":"Do the reported routing effects hold when tested with other routers and workflows?","claims":[{"text":"The authors define shadow invocation as a task-preserving request variant that leads an LLM router to choose a riskier execution path, potentially bypassing security controls.","excerpt":"We study shadow invocation: a task-preserving request variant that causes an LLM router to select a riskier execution path, potentially skipping validation, provenance, staging, redaction, or audit controls","support":"source-stated"},{"text":"In the focused policy-ablation study, efficiency-first routing had a 29.2% shadow-invocation rate and a 26.7% safety-tool skip rate.","excerpt":"Efficiency-first routing produces a 29.2% shadow-invocation rate and 26.7% safety-tool skip rate.","support":"source-stated"},{"text":"The authors report that policy-aware routing reduced shadow invocations by 85.7% relative to efficiency-first routing.","excerpt":"corresponding to an 85.7% relative reduction in shadow invocations.","support":"source-stated"},{"text":"Pre-execution signals distinguished shadow routes with ROC AUC up to 0.94 in the study.","excerpt":"Pre-execution signals distinguish shadow routes with ROC AUC up to 0.94.","support":"source-stated"},{"text":"The authors characterize the findings as early, single-router evidence, not a claim of universal vulnerability.","excerpt":"These results are early, single-router evidence of a policy-dependent routing-layer security effect, not a claim of universal vulnerability.","support":"source-stated"}],"limitations":["The study is described as a focused policy-ablation study using one Groq-hosted qwen/qwen3-32b router, with 120 routing decisions and 96 original-versus-variant comparisons across six security-sensitive workflows.","The source characterizes the results as early, single-router evidence; it does not establish whether the reported effects hold for other routers or workflows."],"mediaId":"e50d7ddeb442d9769254b2b1f8ab555dc070c4f1dd9ee09289fa40a7dcf15751","correctionReason":null,"id":"6fbbd23493774252da7266c892638b92f67e2328e0bf10c0452431e36d4d43ca","publicationId":"fd2bf8ad-b5a3-4693-8ca9-de1c00d62219","version":1,"sourceUrl":"https://arxiv.org/abs/2611.11720","sourceTitle":"ShadowBench-MCP: Measuring Shadow Invocations in MCP-Style Tool Routing","publisher":"arXiv eess.SY","publishedAt":null,"originalPublished":{"value":"2026-11-09","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-10T08:34:18.567Z","createdAt":"2026-11-12T11:32:06.771Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"e50d7ddeb442d9769254b2b1f8ab555dc070c4f1dd9ee09289fa40a7dcf15751","kind":"article","url":"https://arxiv.org/abs/2611.11720","sourceUrl":"https://arxiv.org/abs/2611.11720","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T11:18:40.764Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.11720","checkedAt":"2026-11-12T11:48:09.676Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"e50d7ddeb442d9769254b2b1f8ab555dc070c4f1dd9ee09289fa40a7dcf15751","confidence":0.75,"provider":"typesafe","model":"jev-1.13.0","inputHash":"0137ecea0167e390b8752d5c42e7cc1a0d873ef3145cd12a94d4f211d9299bc1","decidedAt":"2026-11-12T11:18:42.701Z"},"provenance":{"textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observationId":"317baa6c4f429646457b3406076c78635159504e8b30be6c393437bd7ed7b970","retrievedAt":"2026-11-12T11:18:40.499Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"fc7271e8-e050-4ec2-8bab-e132971620c9"},"reviewer":{"model":"gpt-6-luna","runId":"fbb0a0ae-baa9-4adb-8b71-590d3df7e1e4"}},"audit":{"status":"passed","reviewedAt":"2026-11-12T11:32:06.771Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Al-Masri, Eyhab","url":null,"kind":"unknown"},{"name":"Yang, Wenjun","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Al-Masri, Eyhab","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Al-Masri, Eyhab","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.11720","locator":"head/meta[name=author|citation_author]"},"assertionId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T11:48:09.676Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123","sourceUrl":"https://arxiv.org/abs/2611.11720","contentSha256":"2087da9303b828679e0447b136b367f11aacd89c36b27640ea79c6406572ab5c","textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observedAt":"2026-11-12T11:48:09.676Z"}},{"actor":{"name":"Yang, Wenjun","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yang, Wenjun","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.11720","locator":"head/meta[name=author|citation_author]"},"assertionId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T11:48:09.676Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123","sourceUrl":"https://arxiv.org/abs/2611.11720","contentSha256":"2087da9303b828679e0447b136b367f11aacd89c36b27640ea79c6406572ab5c","textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observedAt":"2026-11-12T11:48:09.676Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.11720","snapshotId":"98b6322ce2712b17cb602c45b46c2ca9eb51e2702ebb8f256d12d537083e8123","contentSha256":"2087da9303b828679e0447b136b367f11aacd89c36b27640ea79c6406572ab5c","textHash":"a6e080635015a0f62755a28b7b3d8467d18f0fc433ad7a06fbcc243a9c338183","observedAt":"2026-11-12T11:48:09.676Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/6fbbd23493774252da7266c892638b92f67e2328e0bf10c0452431e36d4d43ca/source"}}}],"audits":[{"publicationId":"fd2bf8ad-b5a3-4693-8ca9-de1c00d62219","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly names Eyhab Al-Masri and Wenjun Yang as the authors and frames the findings as their reported results. The title's 'arXiv eess.SY' label matches the feed publisher. The paper's primary category is cs.CR, with eess.SY as a cross-list, but this does not misattribute the work.","excerpt":"Authors:Eyhab Al-Masri, Wenjun Yang"},{"dimension":"summary","status":"pass","explanation":"The summary leads with the actor and the development. It explains shadow invocation and the idea that an agent's chosen route is a security-relevant output. It keeps the authors' scope caveat. Terms such as MCP, ROC AUC and policy-ablation stay exact for term-library tooltips. They do not block understanding of the central finding: efficiency-first routing skipped safety steps more often than policy-aware routing. The question follows from the source's single-router limitation.","excerpt":"making an execution path - rather than generated text alone - a security-relevant model output"},{"dimension":"date","status":"pass","explanation":"The originalPublished value of 2026-11-09 matches the arXiv v1 submission date. The later feed timestamp of 2026-11-10 is correctly not used.","excerpt":"[Submitted on 9 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each figure is stated in the abstract: 29.2%, 26.7%, the 85.7% relative reduction and ROC AUC up to 0.94. The router, the six workflows and the 120/96 decision counts are also stated. The statement that extension to other routers remains untested follows from the authors' single-router caveat. The reading implies no unsupported benefits or real-world reliability.","excerpt":"These results are early, single-router evidence of a policy-dependent routing-layer security effect, not a claim of universal vulnerability."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper. It is the original source and the most direct access point.","excerpt":null}],"createdAt":"2026-11-12T11:32:06.771Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}