AI Frontier · Sep 17, 2026

Covering September 10 to 17. Four papers this issue take MCP itself as the object of study, and they land in the same place: it moved agents onto a new transport without bringing the old transport's controls along — several input channels share one context window with no privilege separation, so no single channel needs to carry a complete payload for credentials to leak, and traffic on that transport scores a steady zero under enterprise beacon scoring.

Research

Cross-channel fragmentation: no channel carries a complete injection, and the model assembles the fragments into credential exfiltration itself

MCP lets models invoke external tools, and the input channels — tool descriptions, tool results, sampling messages — share a single context window with no privilege separation. The authors first measure a model's trust profile across channels and payload framings, then split seemingly benign payloads across two or three channels. Across 12 frontier models, three production clients, six payloads and over 15,000 trials: models that fully resist single-channel injection (0% compliance) exfiltrate sensitive data at up to 100% under two-channel fragmentation, GPT-4o, Llama 70B, Composer 2 and Haiku 4.5 among them. They also demonstrate value-aligned exploitation, where a tool's stated purpose itself requires the data the attacker wants, and a sampling system-prompt override that injects persistent instructions through VS Code's MCP implementation. Against seven third-party MCP security tools and three prompt-based defences: all seven tools failed to detect fragmented payloads, and the prompt defences proved model-specific rather than universal.

Sources: arXiv

MCP traffic scores 0.0 on enterprise beacon scoring, and does not separate from Cobalt Strike polling

Enterprise defenders have long treated machine-like cadence as an indicator of compromise, and MCP pipes a class of machine-generated, authenticated, high-frequency JSON-RPC traffic straight into enterprise networks. The authors build a Docker testbed with eleven mathematically defined traffic profiles and test Suricata signature matching and RITA behavioural scoring under three TLS conditions — opaque, TLS-inspected and cleartext. Regardless of temporal jitter and regardless of TLS visibility, MCP traffic yields a consistent 0.0 behavioural beacon score and near-zero content alerts under the Emerging Threats Open ruleset. Opaque TLS hides HTTP content but exposes the traffic to flow-level temporal analysis — except that heuristics tuned for traditional malware do not flag the lognormal inter-arrival distributions characteristic of generative AI reasoning loops. They propose an agent-native network indication standard (Agent-Native ALPN plus standardized out-of-band headers). The finding is bounded by their testbed configuration and ruleset.

Sources: arXiv

Trusting trust, new edition: a poisoned benchmark led a self-improving coding agent to evolve instructions that turn off certificate validation

Thompson showed a compiler can be poisoned to reinsert its own backdoor, so that recompiling clean source still reproduces the Trojan. Much coding work is now done by AI agents, and increasingly those agents generate new versions of themselves. The authors move the attack to the agent's self-evaluation and self-improvement loop, supplying poisoned benchmarks to three published self-modifying coding agents — the Darwin Gödel Machine with their own modifications, the Self-Improving Coding Agent and Hyperagents, the latter two substantively unmodified. With Hyperagents powered by Sonnet 4.5, the poisoned benchmark led the agent to self-evolve instructions that disable HTTPS certificate validation on neutral URL-fetching tasks. The sharper point is persistence: contamination often survives when a poisoned agent is subsequently evolved against clean benchmarks. The authors present these as proofs-of-concept and distil the properties of vulnerability, benchmark, model and agent scaffolding sufficient to make the attack work.

Sources: arXiv

Running a model locally does not keep the prompt local: on llama.cpp one client can restore another tenant's conversation

The claim that local inference is more private rests on prompts staying on the device, and the authors ask whether that alone is enough. They build LLAnalyzer to test four boundaries separately — model loading, runtime memory, wrapper-level persistence and the serving interface — across four open-weight model families and two consumer deployment platforms. A 24-hour AFL++ campaign of more than 12 million executions produced no parser crashes and no successful malformed GGUF loads within the state space explored. Runtime memory is another matter: prompts can be recovered after inference because multiple plaintext representations survive in allocator-managed memory, and sanitisation reduces the residue without eliminating it. At the serving boundary they uncover a previously undocumented llama.cpp authorization flaw letting one authenticated client restore another tenant's saved conversation state, succeeding in 200 of 200 controlled trials. Shared prompt-prefix caching separately exposes a remote timing oracle that stays distinguishable under WAN conditions.

Sources: arXiv

When a low-privilege agent is compromised, what holds is structural authorization, not the agent upstream whose job is judgement

The authors test shared-memory poisoning and indirect prompt injection via a forged approval embedded in a retrieved document against a four-agent LangGraph pipeline (Supervisor, Researcher, Validator, Executor), comparing the Validator's judgement with an independent authorization layer built from task-bound signed tokens and a separately verified policy oracle. Across three seeds and 60 labelled tasks, memory poisoning reaches execution in every undefended trial. With authorization enabled the Judgment Bypass Rate is still 100% but the Unsafe Action Rate is 0% — the Validator can remain compromised while execution is contained. Against an attacker holding the signing secret, containment comes from the policy oracle, and an independently authored least-privilege policy preserves the result. An added Observer layer cuts the false-positive rate for agent hijacking from 49% to 7% without weakening execution-level security.

Sources: arXiv

Clean-environment scores understate how badly agents handle deceptive evidence

Security agents read web pages, source code, logs, configuration and command output, and those environments may hold artifacts placed specifically to steer them. The authors separate this from prompt injection and call it adversarial task contamination: beyond attacker-supplied instructions it includes non-instructional evidence such as fake results and decoy endpoints. Their framework AgentLSD uses CTF challenges, injecting fake flags, misleading hints, decoy endpoints and hidden cues while preserving the intended solution, with paired clean and trap-augmented runs. Across six models and 11 web CTF challenges, agents capture 41% of flags in the clean condition and no model solves every challenge. With traps added, even when the agent still recovers the flag it takes about 20 more turns and 2,000 more reasoning tokens; solve-rate effects are uneven — some model-challenge pairs are largely unaffected while others follow decoys or submit wrong flags. The framework, configurations, trap specifications and raw traces are released.

Sources: arXiv

Lab announcements

OpenAI: a framework for reporting model misalignment, published with six behaviour reports (September 16)

The framework covers tracking, investigating and disclosing model misalignment, and comes alongside six reports of unexpected or concerning model behaviour.

Sources: OpenAI

Google: past 300 languages, with the emphasis moving from translating text to understanding how it is expressed (September 15)

Google says its technologies and products now power everyday interactions in more than 300 languages, spoken by more than 7 billion people — 86% of the global population — and that Translate has gone from a handful of languages at its 2006 launch to more than 250 today. The post's argument is that the next step is not text translation but training models to understand the emotion, tone and slang people actually use, working with local communities so the tools also work where connectivity is unreliable.

Sources: Google

OpenAI: an advertising product line, including Sponsored Agents and integrations with HubSpot and Shopify (September 16)

Sources: OpenAI