{"id":"a7468f95c5fea2bfbd6a20dda81ec7efece553b6ba62406a0c3c3fa29ab51754","title":"Paper authors argue signatures cannot establish trust in MCP toolchains","argument":"The authors of “Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains” argue that a valid signature does not make an AI agent’s tool safe: malicious code can hide inside authenticated software and send confidential information to a policy-allowed destination. They demonstrate this with a signed MCP tool. In their test, Meta’s MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.\n\nTheir proposed alternative, germline execution, runs each tool invocation in an ephemeral copy of a data-free germline process. Each copy receives only information authorized for its destination, limiting what malicious code could disclose. The authors prove sink noninterference under explicit assumptions about copy confinement and a data-free germline; for releases deterministic within their replay model, they also show that a verified witness establishes a flow violation.\n\nAcross 153 attack runs, the authors report no unauthorised disclosure detected under germline execution, compared with 5.9–74.5% of runs under baseline defences and an ablation. They report that invocations served by a single copy completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation. The results make the paper’s central distinction concrete: authenticating who published a tool is not the same as limiting what its code can disclose. ","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported protection is conditional on the stated assumptions of copy confinement and a data-free germline. The reported attack-run results and invocation times describe the authors’ evaluations; the supplied abstract does not establish performance or protection in other settings.","speaker":{"name":"Aun, Yichiet, Alhartomi, Mohammed A., Tan, Jing Jie, Nadeem, Waqas, Salh, Adeb, Karuppayah, Shankar, Tan, Sin Chee","roleAtSource":"Article author"},"source":{"title":"Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.06585","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors argue that authenticating a tool does not guarantee benign behaviour, since signed software may conceal code that leaks confidential information.","excerpt":"authenticity does not guarantee benign behaviour: a legitimately signed tool may perform its advertised function while concealing malicious code that leaks confidential information","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"In the authors’ demonstration, MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.","excerpt":"blocks a direct exfiltration attempt in the same run, yet fails to prevent this attack in every trial","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"Germline execution runs invocations in ephemeral copies of a data-free germline process, giving each copy only information authorized for its destination.","excerpt":"Each tool invocation runs in ephemeral copies forked from a data-free germline process, each receiving only information authorised for its destination.","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"The authors prove sink noninterference under explicit assumptions on copy confinement and a data-free germline.","excerpt":"Under explicit assumptions on copy confinement and a data-free germline, we prove sink noninterference for every signed release","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"Across 153 attack runs, the authors report no unauthorised disclosure detected under germline execution; baseline defences and an ablation detected disclosure in 5.9–74.5% of runs.","excerpt":"Across 153 attack runs, no unauthorised disclosure was detected under germline execution, compared with 5.9-74.5% of runs under baseline defences and an ablation.","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"The authors report that single-copy invocations completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation.","excerpt":"Invocations served by a single copy completed in 10-49 ms, 2-28x faster than restarting the tool for every invocation","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06585","checkedAt":"2026-11-10T02:42:07.516Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the reported protection change if the assumptions of copy confinement and a data-free germline did not hold?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Paper authors argue signatures cannot establish trust in MCP toolchains","summary":"The authors of “Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains” argue that a valid signature does not make an AI agent’s tool safe: malicious code can hide inside authenticated software and send confidential information to a policy-allowed destination. They demonstrate this with a signed MCP tool. In their test, Meta’s MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.\n\nTheir proposed alternative, germline execution, runs each tool invocation in an ephemeral copy of a data-free germline process. Each copy receives only information authorized for its destination, limiting what malicious code could disclose. The authors prove sink noninterference under explicit assumptions about copy confinement and a data-free germline; for releases deterministic within their replay model, they also show that a verified witness establishes a flow violation.\n\nAcross 153 attack runs, the authors report no unauthorised disclosure detected under germline execution, compared with 5.9–74.5% of runs under baseline defences and an ablation. They report that invocations served by a single copy completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation. The results make the paper’s central distinction concrete: authenticating who published a tool is not the same as limiting what its code can disclose. ","question":"How would the reported protection change if the assumptions of copy confinement and a data-free germline did not hold?","claims":[{"text":"The authors argue that authenticating a tool does not guarantee benign behaviour, since signed software may conceal code that leaks confidential information.","excerpt":"authenticity does not guarantee benign behaviour: a legitimately signed tool may perform its advertised function while concealing malicious code that leaks confidential information","support":"source-stated"},{"text":"In the authors’ demonstration, MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.","excerpt":"blocks a direct exfiltration attempt in the same run, yet fails to prevent this attack in every trial","support":"source-stated"},{"text":"Germline execution runs invocations in ephemeral copies of a data-free germline process, giving each copy only information authorized for its destination.","excerpt":"Each tool invocation runs in ephemeral copies forked from a data-free germline process, each receiving only information authorised for its destination.","support":"source-stated"},{"text":"The authors prove sink noninterference under explicit assumptions on copy confinement and a data-free germline.","excerpt":"Under explicit assumptions on copy confinement and a data-free germline, we prove sink noninterference for every signed release","support":"source-stated"},{"text":"Across 153 attack runs, the authors report no unauthorised disclosure detected under germline execution; baseline defences and an ablation detected disclosure in 5.9–74.5% of runs.","excerpt":"Across 153 attack runs, no unauthorised disclosure was detected under germline execution, compared with 5.9-74.5% of runs under baseline defences and an ablation.","support":"source-stated"},{"text":"The authors report that single-copy invocations completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation.","excerpt":"Invocations served by a single copy completed in 10-49 ms, 2-28x faster than restarting the tool for every invocation","support":"source-stated"}],"limitations":["The reported protection is conditional on the stated assumptions of copy confinement and a data-free germline.","The reported attack-run results and invocation times describe the authors’ evaluations; the supplied abstract does not establish performance or protection in other settings."],"mediaId":"e6f3ab7747516421e4c6d49ee71152c42710181380919c61e48ce106a8488b60","correctionReason":null,"id":"a7468f95c5fea2bfbd6a20dda81ec7efece553b6ba62406a0c3c3fa29ab51754","publicationId":"d5055888-4446-495e-8069-ac7bc0ef1119","version":1,"sourceUrl":"https://arxiv.org/abs/2611.06585","sourceTitle":"Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:09:22.342Z","createdAt":"2026-11-09T09:38:36.655Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"e6f3ab7747516421e4c6d49ee71152c42710181380919c61e48ce106a8488b60","kind":"article","url":"https://arxiv.org/abs/2611.06585","sourceUrl":"https://arxiv.org/abs/2611.06585","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T09:34:37.357Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06585","checkedAt":"2026-11-10T02:42:07.516Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"e6f3ab7747516421e4c6d49ee71152c42710181380919c61e48ce106a8488b60","confidence":0.88,"provider":"typesafe","model":"jev-1.13.0","inputHash":"d6829bcbbd4677716f325e1f6740671edb65bee6db7f93160484b7cb3128abec","decidedAt":"2026-11-09T09:34:39.385Z"},"provenance":{"textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observationId":"d3cb63d431d226d592434ae60dde89b9e92979fe0eabb6cc240d5fbc70e14a6c","retrievedAt":"2026-11-09T09:34:36.991Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"5bd9deb4-3190-4eaf-8cff-19a555a0e0a5"},"reviewer":{"model":"gpt-6-luna","runId":"e00f28aa-bd77-4250-8c78-da9de838d95b"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-09T09:38:36.655Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Aun, Yichiet","url":null,"kind":"unknown"},{"name":"Alhartomi, Mohammed A.","url":null,"kind":"unknown"},{"name":"Tan, Jing Jie","url":null,"kind":"unknown"},{"name":"Nadeem, Waqas","url":null,"kind":"unknown"},{"name":"Salh, Adeb","url":null,"kind":"unknown"},{"name":"Karuppayah, Shankar","url":null,"kind":"unknown"},{"name":"Tan, Sin Chee","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Aun, Yichiet","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Aun, Yichiet","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Alhartomi, Mohammed A.","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Alhartomi, Mohammed A.","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Tan, Jing Jie","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tan, Jing Jie","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Nadeem, Waqas","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Nadeem, Waqas","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Salh, Adeb","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Salh, Adeb","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Karuppayah, Shankar","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Karuppayah, Shankar","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Tan, Sin Chee","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tan, Sin Chee","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}}],"participationCoverage":{"total":7,"returned":7,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.06585","snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z","basis":"publisher-page-metadata","sourceLinks":47,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/a7468f95c5fea2bfbd6a20dda81ec7efece553b6ba62406a0c3c3fa29ab51754/source"}},"canonicalUrl":"https://escapemeridian.com/readings/paper-authors-argue-signatures-cannot-establish-trust-in-mcp-a7468f95","formats":{"html":"/readings/paper-authors-argue-signatures-cannot-establish-trust-in-mcp-a7468f95","markdown":"/readings/paper-authors-argue-signatures-cannot-establish-trust-in-mcp-a7468f95.md","json":"/readings/paper-authors-argue-signatures-cannot-establish-trust-in-mcp-a7468f95.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-ai-agent","name":"AI agent","explanation":"An AI system that chooses and carries out actions toward a goal, often using software tools.","referenceUrl":"https://www.ibm.com/think/topics/ai-agents"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"a7468f95c5fea2bfbd6a20dda81ec7efece553b6ba62406a0c3c3fa29ab51754","revision":"d5055888-4446-495e-8069-ac7bc0ef1119","revisionKind":"publication-id","title":"Paper authors argue signatures cannot establish trust in MCP toolchains","url":"https://escapemeridian.com/readings/paper-authors-argue-signatures-cannot-establish-trust-in-mcp-a7468f95"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.06585","revision":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","revisionKind":"sha256-source-text","title":"Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains","url":"https://arxiv.org/abs/2611.06585"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"a7468f95c5fea2bfbd6a20dda81ec7efece553b6ba62406a0c3c3fa29ab51754","title":"Paper authors argue signatures cannot establish trust in MCP toolchains","argument":"The authors of “Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains” argue that a valid signature does not make an AI agent’s tool safe: malicious code can hide inside authenticated software and send confidential information to a policy-allowed destination. They demonstrate this with a signed MCP tool. In their test, Meta’s MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.\n\nTheir proposed alternative, germline execution, runs each tool invocation in an ephemeral copy of a data-free germline process. Each copy receives only information authorized for its destination, limiting what malicious code could disclose. The authors prove sink noninterference under explicit assumptions about copy confinement and a data-free germline; for releases deterministic within their replay model, they also show that a verified witness establishes a flow violation.\n\nAcross 153 attack runs, the authors report no unauthorised disclosure detected under germline execution, compared with 5.9–74.5% of runs under baseline defences and an ablation. They report that invocations served by a single copy completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation. The results make the paper’s central distinction concrete: authenticating who published a tool is not the same as limiting what its code can disclose. ","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported protection is conditional on the stated assumptions of copy confinement and a data-free germline. The reported attack-run results and invocation times describe the authors’ evaluations; the supplied abstract does not establish performance or protection in other settings.","speaker":{"name":"Aun, Yichiet, Alhartomi, Mohammed A., Tan, Jing Jie, Nadeem, Waqas, Salh, Adeb, Karuppayah, Shankar, Tan, Sin Chee","roleAtSource":"Article author"},"source":{"title":"Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.06585","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors argue that authenticating a tool does not guarantee benign behaviour, since signed software may conceal code that leaks confidential information.","excerpt":"authenticity does not guarantee benign behaviour: a legitimately signed tool may perform its advertised function while concealing malicious code that leaks confidential information","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"In the authors’ demonstration, MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.","excerpt":"blocks a direct exfiltration attempt in the same run, yet fails to prevent this attack in every trial","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"Germline execution runs invocations in ephemeral copies of a data-free germline process, giving each copy only information authorized for its destination.","excerpt":"Each tool invocation runs in ephemeral copies forked from a data-free germline process, each receiving only information authorised for its destination.","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"The authors prove sink noninterference under explicit assumptions on copy confinement and a data-free germline.","excerpt":"Under explicit assumptions on copy confinement and a data-free germline, we prove sink noninterference for every signed release","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"Across 153 attack runs, the authors report no unauthorised disclosure detected under germline execution; baseline defences and an ablation detected disclosure in 5.9–74.5% of runs.","excerpt":"Across 153 attack runs, no unauthorised disclosure was detected under germline execution, compared with 5.9-74.5% of runs under baseline defences and an ablation.","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"},{"text":"The authors report that single-copy invocations completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation.","excerpt":"Invocations served by a single copy completed in 10-49 ms, 2-28x faster than restarting the tool for every invocation","url":"https://arxiv.org/abs/2611.06585","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06585","checkedAt":"2026-11-10T02:42:07.516Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the reported protection change if the assumptions of copy confinement and a data-free germline did not hold?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Paper authors argue signatures cannot establish trust in MCP toolchains","summary":"The authors of “Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains” argue that a valid signature does not make an AI agent’s tool safe: malicious code can hide inside authenticated software and send confidential information to a policy-allowed destination. They demonstrate this with a signed MCP tool. In their test, Meta’s MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.\n\nTheir proposed alternative, germline execution, runs each tool invocation in an ephemeral copy of a data-free germline process. Each copy receives only information authorized for its destination, limiting what malicious code could disclose. The authors prove sink noninterference under explicit assumptions about copy confinement and a data-free germline; for releases deterministic within their replay model, they also show that a verified witness establishes a flow violation.\n\nAcross 153 attack runs, the authors report no unauthorised disclosure detected under germline execution, compared with 5.9–74.5% of runs under baseline defences and an ablation. They report that invocations served by a single copy completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation. The results make the paper’s central distinction concrete: authenticating who published a tool is not the same as limiting what its code can disclose. ","question":"How would the reported protection change if the assumptions of copy confinement and a data-free germline did not hold?","claims":[{"text":"The authors argue that authenticating a tool does not guarantee benign behaviour, since signed software may conceal code that leaks confidential information.","excerpt":"authenticity does not guarantee benign behaviour: a legitimately signed tool may perform its advertised function while concealing malicious code that leaks confidential information","support":"source-stated"},{"text":"In the authors’ demonstration, MCPGuard-Dynamic blocks a direct exfiltration attempt but fails to prevent the concealed attack in every trial.","excerpt":"blocks a direct exfiltration attempt in the same run, yet fails to prevent this attack in every trial","support":"source-stated"},{"text":"Germline execution runs invocations in ephemeral copies of a data-free germline process, giving each copy only information authorized for its destination.","excerpt":"Each tool invocation runs in ephemeral copies forked from a data-free germline process, each receiving only information authorised for its destination.","support":"source-stated"},{"text":"The authors prove sink noninterference under explicit assumptions on copy confinement and a data-free germline.","excerpt":"Under explicit assumptions on copy confinement and a data-free germline, we prove sink noninterference for every signed release","support":"source-stated"},{"text":"Across 153 attack runs, the authors report no unauthorised disclosure detected under germline execution; baseline defences and an ablation detected disclosure in 5.9–74.5% of runs.","excerpt":"Across 153 attack runs, no unauthorised disclosure was detected under germline execution, compared with 5.9-74.5% of runs under baseline defences and an ablation.","support":"source-stated"},{"text":"The authors report that single-copy invocations completed in 10–49 ms, 2–28x faster than restarting the tool for every invocation.","excerpt":"Invocations served by a single copy completed in 10-49 ms, 2-28x faster than restarting the tool for every invocation","support":"source-stated"}],"limitations":["The reported protection is conditional on the stated assumptions of copy confinement and a data-free germline.","The reported attack-run results and invocation times describe the authors’ evaluations; the supplied abstract does not establish performance or protection in other settings."],"mediaId":"e6f3ab7747516421e4c6d49ee71152c42710181380919c61e48ce106a8488b60","correctionReason":null,"id":"a7468f95c5fea2bfbd6a20dda81ec7efece553b6ba62406a0c3c3fa29ab51754","publicationId":"d5055888-4446-495e-8069-ac7bc0ef1119","version":1,"sourceUrl":"https://arxiv.org/abs/2611.06585","sourceTitle":"Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:09:22.342Z","createdAt":"2026-11-09T09:38:36.655Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"e6f3ab7747516421e4c6d49ee71152c42710181380919c61e48ce106a8488b60","kind":"article","url":"https://arxiv.org/abs/2611.06585","sourceUrl":"https://arxiv.org/abs/2611.06585","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T09:34:37.357Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06585","checkedAt":"2026-11-10T02:42:07.516Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"e6f3ab7747516421e4c6d49ee71152c42710181380919c61e48ce106a8488b60","confidence":0.88,"provider":"typesafe","model":"jev-1.13.0","inputHash":"d6829bcbbd4677716f325e1f6740671edb65bee6db7f93160484b7cb3128abec","decidedAt":"2026-11-09T09:34:39.385Z"},"provenance":{"textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observationId":"d3cb63d431d226d592434ae60dde89b9e92979fe0eabb6cc240d5fbc70e14a6c","retrievedAt":"2026-11-09T09:34:36.991Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"5bd9deb4-3190-4eaf-8cff-19a555a0e0a5"},"reviewer":{"model":"gpt-6-luna","runId":"e00f28aa-bd77-4250-8c78-da9de838d95b"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-09T09:38:36.655Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Aun, Yichiet","url":null,"kind":"unknown"},{"name":"Alhartomi, Mohammed A.","url":null,"kind":"unknown"},{"name":"Tan, Jing Jie","url":null,"kind":"unknown"},{"name":"Nadeem, Waqas","url":null,"kind":"unknown"},{"name":"Salh, Adeb","url":null,"kind":"unknown"},{"name":"Karuppayah, Shankar","url":null,"kind":"unknown"},{"name":"Tan, Sin Chee","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Aun, Yichiet","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Aun, Yichiet","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Alhartomi, Mohammed A.","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Alhartomi, Mohammed A.","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Tan, Jing Jie","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tan, Jing Jie","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Nadeem, Waqas","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Nadeem, Waqas","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Salh, Adeb","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Salh, Adeb","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Karuppayah, Shankar","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Karuppayah, Shankar","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}},{"actor":{"name":"Tan, Sin Chee","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tan, Sin Chee","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06585","locator":"head/meta[name=author|citation_author]"},"assertionId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T02:42:07.516Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","sourceUrl":"https://arxiv.org/abs/2611.06585","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z"}}],"participationCoverage":{"total":7,"returned":7,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.06585","snapshotId":"8e164bc8c778dc6c8b5b6f548721806704abca03286ff8aca4e4fd40dd0bb161","contentSha256":"9782c42dae47541f861a89c12f4a44c791e4a7b8c33cbe34165584592ccf9da1","textHash":"e01d2a63eb104c91672cfc20cde1d6e4a3de0a58e487eaed79ad42baa4c4c12f","observedAt":"2026-11-10T02:42:07.516Z","basis":"publisher-page-metadata","sourceLinks":47,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/a7468f95c5fea2bfbd6a20dda81ec7efece553b6ba62406a0c3c3fa29ab51754/source"}}}],"audits":[{"publicationId":"d5055888-4446-495e-8069-ac7bc0ef1119","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The claims are consistently attributed to the paper's authors as arguments, demonstrations, proofs or reported results. Meta's MCPGuard-Dynamic is correctly identified as the runtime defence the authors tested, not as a source of claims.","excerpt":"Meta's MCPGuard-Dynamic, a state-of-the-art runtime defence, blocks a direct exfiltration attempt in the same run, yet fails to prevent this attack in every trial."},{"dimension":"summary","status":"uncertain","explanation":"The reading is faithful, but several central terms go unexplained for a non-specialist: MCP (Model Context Protocol servers), exfiltration, sink noninterference, verified witness, flow violation and ablation. Smallest repair: add term-library tooltips for these. The title's 'cannot establish trust' is slightly stronger than the source's 'authenticity does not guarantee benign behaviour'; 'do not guarantee safe behaviour' would be closer. The summary also omits that germline execution works without inspecting or trusting tool code, which is a key part of the authors' pitch.","excerpt":"We introduce germline execution, which limits information disclosure without inspecting or trusting tool implementations."},{"dimension":"date","status":"pass","explanation":"originalPublished 2026-11-04 matches the arXiv v1 submission date. The feed date of 2026-11-05 is later and correctly not used.","excerpt":"[Submitted on 4 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"All six claims are exact or close restatements of the abstract. The limitations properly note the assumption-dependence and the evaluation scope. The question follows directly from the stated assumptions and is not a leading claim. No unsupported benefits or costs are implied.","excerpt":"Across 153 attack runs, no unauthorised disclosure was detected under germline execution, compared with 5.9-74.5% of runs under baseline defences and an ablation."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for the source paper. That is the most direct access point to the original source.","excerpt":null}],"createdAt":"2026-11-09T09:38:36.655Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}