A paper titled Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines (arXiv:2609.18217, category cs.CR) by Murali Ediga and Sudipta Chattopadhyay from the University of Missouri-Kansas City was published on arXiv. The authors demonstrated that in the Model Context Protocol, the authority of input channels—tool descriptions, their invocation results, and sampling messages—is a learned property of the model, not an architectural guarantee. If a malicious instruction is split into fragments and distributed across two to three channels, models fully resistant to single-channel injections began leaking sensitive data, and none of the tested third-party MCP security tools detected such payloads.
What happened
On September 16, 2026, a paper with a two-stage evaluation and attack methodology appeared in the cs.CR category on arXiv. First, the model's "trust profile" is measured: how it treats five input channels under six types of payloads. Then, an attacker distributes the injection across two to three channels so that no single channel contains the complete instruction in isolation. The experiments covered 12 frontier models, 3 industrial MCP clients, and at least 15,465 trials. According to the authors, models with a zero consent rate to single-channel injection—including GPT-4o, Llama 70B, Composer 2, and Haiku 4.5—exfiltrated sensitive data in up to 100% of cases under two-channel fragmentation. All 7 tested third-party MCP security tools missed the fragmented payloads, and three prompt defenses proved model-specific.
Context
The Model Context Protocol is an open standard for connecting tools to LLMs. Tool descriptions, their invocation results, and sampling messages enter a unified context without privilege separation, so the model learns differences in the reliability of context sources from training rather than receiving them from the protocol. The idea of injection via external content is not new: indirect prompt injection is a known class of attacks, and composing a payload across channels is an evolution of it, not the emergence of a new category. The methodological novelty of the work lies elsewhere: the authors brought adaptive attack logic into the evaluation of agentic pipelines, where the splitting of the injection is tailored to the measured trust profile of a specific model. Single-channel tests, on which previous conclusions about robustness were based, checked the reaction to a full payload in one channel and therefore measured the wrong threat that is possible in a real pipeline.
Why this matters for the industry
The blow landed on security evaluation practices: results of tests for single-channel injections can no longer be considered proof of the robustness of agentic systems. Static detectors look for a complete malicious payload in one channel, whereas in this scheme the payload is distributed, so the signature-based approach does not work: prompt defenses triggered only for individual models. The authors conclude that MCP client vendors and server registry authors need architectural privilege separation of channels and per-model validation. If the results are replicated, a wave of updates is likely: multi-channel scenarios in safety benchmarks, channel isolation modes in clients, vetting in server registries, and per-model adversarial profiling in release checklists for agentic products. The emerging market for trusted infrastructure for agents is currently a hypothesis, but the methodology has already been published and the barrier to entry for its reproduction is low.
Why this matters for users
The risk concerns those working in agentic environments with MCP support: Cursor, VS Code with Copilot, Claude Code, Codex CLI. A malicious or compromised third-party MCP server can force the model to pass the contents of .env, SSH keys, or source code to it through seemingly harmless tool invocation parameters. Until architectural fixes appear, it is reasonable to install servers only from verified sources and conduct an inventory of already connected ones, remove secrets from the agent's line of sight by replacing raw files with scoped tokens, isolate the file system and network for agentic runs, and also check how the context received by the model is assembled.
What is still unknown / limitations
The results have not yet undergone independent replication: the figures on exfiltration up to 100% remain data from a single research group. Composing a payload across channels is an evolution of the known indirect prompt injection class, not a new category of attacks; it is more correct to speak of a categorical shift in relation to the market for security tools, and even then only as a hypothesis until independent verification. The available material does not list the names of the three industrial clients and the seven tested security tools, and the model-specificity of prompt defenses limits generalizing the conclusions to other models. Expectations regarding the timing of updates to evaluation infrastructure and MCP clients are interpretations, not confirmed vendor plans.
Sources
- Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines (arXiv:2609.18217)
- Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines (HTML full text, arXiv:2609.18217v1)
- Hacker News discussion: Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines
Author
Look at AI, editorial team