LATIDIA · Ciberseguridad

Firmado, sellado, filtrado: Confianza más allá de la firma para las cadenas de herramientas MCP

arXiv: 2611.06585v1Tipo de anuncio: nuevo Resumen: los agentes de IA dependen de herramientas de terceros, como servidores de Protocolo de Contexto de Modelo (MCP), cuyos editores pueden autenticarse y cuya ejecución puede ser restringida por el tiempo de ejecución se

La noticia

arXiv:2611.06585v1 Announce Type: new Abstract: AI agents rely on third-party tools, such as Model Context Protocol (MCP) servers, whose publishers can be authenticated and whose execution can be restricted by runtime security policies. Yet authenticity does not guarantee benign behaviour: a legitimately signed tool may perform its advertised function while concealing malicious code that leaks confidential information. We demonstrate this trust failure with a signed MCP tool that embeds sensitive data in requests to a policy-allowed destination. Meta's MCPGuard-Dynamic, a state-of-the-art runtime defence, blocks a direct exfiltration attempt in the same run, yet fails to prevent this attack in every trial. We introduce germline execution, which limits information disclosure without