Trust Laundering in MCP: Binding Provenance at Decode Time

What is this?

On 22 October 2026, Eric Yocam, Varghese Vaidyan, Paris Kalathas, Patrick Tague, Bruce DeBruhl and Yong Wang posted “Agentic AI Defense: Decode-Time Provenance Binding for MCP” to arXiv (2610.31974, cs.CR). The paper studies agents that use the Model Context Protocol (MCP) and are exposed to indirect prompt injection through untrusted tool output.

The authors describe a pattern they call cross-modal trust laundering. Instructions are embedded in an image, for example an email signature, using steganographic carriers. A text scanner never sees them. Once a tool decodes the image, the extracted text enters a multi-agent workflow, where it can look like ordinary trusted content.

How it works

The weakness is a label problem rather than a prompt problem. Content that began as untrusted (an image from an external email) is transformed by a tool into plain text, and the “untrusted” status is lost along the way. Downstream agents then treat the text like any other tool result.

The paper’s testbed is a real MCP environment with three steganographic carriers and 24 adaptive payloads. According to the authors, an undefended pipeline was fully compromised (100% attack success), and keyword and regex filters still let 62.5% of attacks through each. The threat model also includes a compromised agent that tries to substitute a valid trust label.

The proposed defense, decode-time provenance binding, has four parts: marking content as untrusted at the moment it is decoded, authenticating trust labels with an HMAC, tracking lineage in a provenance ledger so taint follows derived content, and enforcing at the sink, so that critical tool calls influenced by tainted content are blocked. In the authors’ tests this blocked all attacks (0% success), including label substitution across mediated agent boundaries. This write-up does not reproduce any payload or embedding procedure.

Why it matters

Many agent stacks scan text for suspicious phrases before it reaches the model. This work illustrates why that is a weak boundary: the dangerous content can arrive in a form the scanner cannot read and become text later, inside a trusted component. Email, document and ticket pipelines that process attachments are the obvious exposure.

The result also carries limits the authors state themselves. Containment holds only inside fully mediated MCP execution environments. Results come from one testbed with 24 payloads, so they should be read as evidence for the approach and not as a guarantee. Legitimate-task completion was initially 67%, rising to 100% only after an audited trusted-promotion mechanism was added, so the defense has a usability cost that has to be engineered.

Defenses

• Treat every decoded or transformed artifact (OCR output, image captions, parsed attachments) as untrusted by default, whatever the trust level of its source tool.
• Carry provenance with the data: attach authenticated labels and propagate taint to anything derived from untrusted content.
• Enforce at the action, not only at the input: block or require human approval for high-risk tool calls whose inputs depend on tainted content, in line with OWASP’s guidance on least privilege and human approval for privileged operations.
• Segregate and clearly identify external content, as the OWASP LLM01 guidance recommends, and note that OWASP flags hidden instructions in images as a multimodal risk.
• Do not rely on keyword or regex filters alone; include multimodal inputs in adversarial testing.
• Audit any “trusted promotion” path, since it becomes the new place an attacker will look.

Status

Item	Detail
Paper	arXiv 2610.31974, submitted 22 October 2026 (v1)
Type	Research defense plus evaluation, not a vendor vulnerability
Vendor patch	Not applicable; no specific product is named in the paper summary reviewed
Code and data	The authors state they are publicly available
Scope limit	Containment shown within fully mediated MCP environments