Guardrails Fail: MCP File Leaks, Copilot RCE, and Multilingual Agent Guard Blind Spots

Title

Guardrails Fail: MCP File Leaks, Copilot RCE, and Multilingual Agent Guard Blind Spots

Meta Description

This week's AI security research reveals systematic guardrail failures in edge cases: 16.4% of MCP servers exhibit filesystem capability laundering, Visual Studio Copilot has a CVE where indirect prompt injection escalates to RCE, small guard models drift under multilingual input, and the INFUSE benchmark quantifies the real risk of indirect injection.

Article Content

This week's AI security developments point to a common conclusion: the guardrails and classifiers that perform well on aggregate metrics are quietly failing in edge cases. From filesystem capability laundering in MCP servers to a remote code execution vulnerability in Visual Studio Copilot to judgment drift in guard models under multilingual input, independent research corroborates the same point from different angles — security controls cannot be built on model judgment; they must rest on real system boundaries.

1. Large-scale filesystem capability laundering in MCP servers

A recent arXiv study, "My Credentials, Please," is the first to systematically define and quantify "filesystem capability laundering" in MCP servers: an attacker manipulates tool parameters so that a tool declared as a non-filesystem class reads host files outside its declared scope.

The research team scanned 21,097 MCP servers across 9 registries. Of 4,806 triaged servers, 787 (16.4%) actually had filesystem capabilities but were classified as non-filesystem. Of these, 150 instances were dynamically confirmed vulnerable, and 13 security advisories have been published, including two CVEs in Anthropic's own Git MCP Server.

This is not theoretical. For any team running third-party MCP servers, a 16.4% misclassification rate means capability classification itself can no longer be trusted, and independent runtime boundary checks are needed.

MCP (Model Context Protocol) is an open protocol proposed by Anthropic in late 2024 to standardize how AI assistants connect to external tools and data sources. Its core abstraction is the "server": each MCP server declares to the client the toolset it provides and the capabilities it requires (such as file read/write, network access, database queries). The client uses this to decide whether to authorize calls. However, this trust model based on self-declaration has a fundamental flaw — the protocol itself does not force servers to truthfully declare capabilities, nor does it verify at runtime whether a tool's actual behavior exceeds its declared scope. "Capability laundering" refers precisely to attackers exploiting this trust gap: through carefully crafted tool parameters, a tool claiming to be "non-filesystem class" performs file read operations at runtime, bypassing access controls based on capability classification. The root of this problem is that capability classification occurs at installation or registration time, while actual harm occurs at invocation time, with no independent runtime boundary check between the two.

2. Visual Studio Copilot RCE: When path validation is defeated by the operating system

wunderwuzzi of Embrace The Red disclosed CVE-2026-103572, a path validation bypass vulnerability in GitHub Copilot within Visual Studio and SSMS, with a CVSS score of 8.8, rated "Important" by Microsoft.

The root cause is a Win32 quirk: Windows ignores trailing dots in filenames, so the validation logic considers .mcp.json. different from the protected .mcp.json, but the write operation actually still lands on the protected file. The problem lies in the EditsFunctionHandler.GetEditConfirmationTypeAsync method.

The attack path is clear: a misbehaving Agent, or indirect prompt injection triggered by content returned from an MCP server, can be used to register a malicious MCP server or replace the ripgrep path in settings.VisualStudio.json, ultimately achieving arbitrary command execution. The proof of concept popped a calculator. Microsoft fixed it in Patch Tuesday by normalizing paths through a GetFullPath call.

The value of this case is that it demonstrates a complete chain: how indirect prompt injection escalates to remote code execution when a coding Agent has write permission to a "protected" configuration file. Path whitelists require real normalization, not naive string comparison.

Win32 path canonicalization is a classic trap in the Windows filesystem. Windows APIs automatically strip trailing dots and spaces when opening files, so .mcp.json., .mcp.json , and .mcp.json point to the same file; in addition, there are many ambiguous forms such as short filenames (8.3 format), alternate data streams (ADS), UNC paths, and device paths (such as \\.\C:). Secure path validation must first normalize user input into an absolute canonical path through APIs such as GetFullPathName or PathCchCanonicalize, then compare it against the whitelist. Naive string comparison (such as string.Equals) or simple StartsWith checks can be bypassed by the ambiguities above. Microsoft's switch to a GetFullPath call in the patch is precisely to complete normalization before comparison. This vulnerability pattern is not unique to Copilot — any code that does path whitelist validation on Windows may repeat the mistake, including plugin systems, configuration loaders, and sandboxed file access layers.

3. The INFUSE benchmark: How much can guardrails actually stop?

"INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems" provides the first end-to-end quantitative answer. The benchmark includes 40 real Agent tasks, a taxonomy of 56 attack scenarios covering 5 threat categories, and tests about 41,800 adversarial trajectories across 19 LLMs.

The results are not encouraging: under LLM judging, the average attack success rate is 19.6% (15.4% under heuristic checks), and existing guard models provide limited protection. Prompt-level hardening can reduce the average success rate from 58.2% to 14.3%, but at a utility cost.

For teams operating long-running Agents, this benchmark provides concrete numbers to calibrate the real value of guardrails, rather than relying on vendor claims.

Indirect Prompt Injection (IPI) refers to attackers embedding malicious instructions into external content that the Agent retrieves during task execution (web pages, documents, tool return results, emails, etc.), rather than coming directly from user input. Compared with direct prompt injection, IPI is more insidious: the user themselves is benign, but the Agent is hijacked while "reading" untrusted content. The "end-to-end" nature of the INFUSE benchmark means it does not merely test classifier accuracy on isolated samples; it lets attacks unfold within complete multi-step Agent task chains and measures whether the final task was successfully hijacked — much closer to real production risk. End-to-end evaluation usually yields more pessimistic conclusions than component-level evaluation, because the attack surface covers tool calls, memory writes, multi-turn reasoning, and other links. Understanding this helps explain why "prompt hardening," although it can reduce the success rate from 58.2% to 14.3%, still cannot bring it to zero and comes at the cost of reduced task utility.

4. Detector scores cannot directly support release decisions

"From Detection to Decision" studies a question closer to production: when the question changes from "is this prompt injection" to "allow, block, or escalate," can detectors still be relied upon?

The study evaluated Jev, two versions of Llama Prompt Guard 2, and an LLM judge on 47,611 held-out samples. The conclusion: to achieve a 1% false negative rate, all tested systems would need to escalate more than 91.8% of inputs to human review, accompanied by a large number of false positives.

This means decisions based on a single detector score are untenable. Teams need explicit escalation policies, not just a threshold.

5. Language itself is an attack surface for Agent guards

"Language Is a Security Surface for Agent Guards" reveals a risk dimension completely ignored by English-only evaluation: guard model judgments change with the language of the user instruction.

The study translated instructions into German, French, Turkish, Swahili, and Amharic, keeping other conditions constant across 1,220 annotated steps. Smaller open-source guard models showed judgment shifts far beyond normal noise, and the more obscure the language, the more pronounced the shift; frontier guard models fluctuated less; English paraphrasing had less impact on judgments than translation. The authors released the benchmark and 489k judgment records.

For teams using small or self-hosted guard models in multilingual products, this is a direct warning: every language has its own risk surface.

Guard models are typically small classifiers fine-tuned on English corpora (such as the Llama Prompt Guard series), deployed between user input and the main model for security filtering. Their risk assessments are almost entirely based on English benchmarks, but production systems often serve multilingual users. When the same malicious instruction is translated into non-English languages such as German or Swahili, the guard model's internal representation shifts: tokenizers split low-resource languages more finely, training distribution coverage is sparser, and semantic alignment is weaker, causing classification boundaries to drift. Attackers do not need to construct complex adversarial examples; simply switching the instruction language can probe the guard's blind spots. This risk is especially prominent for self-hosted small guards, because frontier large models usually have stronger multilingual capabilities and more stable judgments. For multilingual products, guard policies need to calibrate thresholds per language, or uniformly escalate low-resource language inputs to human review or review channels using stronger models.

6. Other notable research and developments

New RAG poisoning technique: "Poisoning the Neighborhood" proposes a topology-aware topic-level poisoning attack against large-scale RAG systems based on HNSW indexes, using "Hub" and "Satellite" documents to occupy semantic regions of the graph. On a 2-million-document Wikipedia corpus, the retrieval success rate exceeds 72%, the attack success rate is 31.29%, and all existing poisoning defenses fail. Production systems using HNSW solutions such as Faiss and Milvus need to be vigilant.

Blind spots in Agent monitoring: "Screwtape" proposes an adversarial transcript editing pipeline that introduces specific harms (such as API key leakage) into real Agent transcripts (Claude Code, Codex), testing whether "action monitors" that focus only on actions and not full reasoning can detect them. Across 94 transcripts, 35 attacks bypassed the authors' own monitor (out of 252 runs), and 6 human-confirmed attacks also bypassed external frontier developers' monitors.

Anthropic's distillation defense: Anthropic announced a three-pronged approach against distillation attacks: limiting where "thinking" output leaks, a two-stage classifier with a false positive rate below 0.1%, and banning repeat-offender accounts. Extractable reasoning tokens reportedly dropped by 10 to 100 times. For teams exposing chain-of-thought or reasoning traces through APIs, this is essential reading.

Self-replicating model experiment: Anthropic's Frontier Red Team demonstrated distributed inference of small models ranging from 9B to 26B parameters on cheap consumer hardware such as smart TV boxes and IoT devices, and predicted that by the end of 2026, models under 30B might be chained together to complete each step of self-replication. This is more relevant for threat modeling of infrastructure and edge devices.

Independent evaluator program: Anthropic gave METR near-employee-level access (hardware, internal systems) and expanded cooperation with organizations such as SecureBio and Accenture, adopting a three-tier access and release model. For teams building external red team programs, this is a reference governance structure.

The thread running through this week

Looking at this week's independent findings together, the pattern is highly consistent: INFUSE shows guard models are nearly insensitive to indirect injection in Agent benchmarks; calibration and latency research shows detector scores cannot support release decisions; the MCP capability laundering scan shows one in six servers is misclassified; and the language-surface research shows small guards quietly drift on non-English input. Add to that the Visual Studio Copilot RCE — where path validation that looked correct in testing was defeated by an operating-system-level filename quirk — and the conclusion is clear: security controls built on top of Agents cannot assume that the Agent itself, or the checks protecting it, will behave as expected. Verification must occur at real system boundaries — file paths, retrieval indexes, guard policies — not in the model's judgment.

One-line Summary

Multiple independent studies this week collectively show that AI guardrails with good aggregate metrics are quietly failing in edge cases, and security controls must rest on real system boundaries rather than model judgment.

Paragraph Summary

This week's AI security developments point from five independent directions to the same conclusion: security controls based on model judgment are unreliable. An MCP server scan found 16.4% exhibit filesystem capability laundering; Visual Studio Copilot's CVE-2026-103572 shows how a Win32 path quirk escalates indirect prompt injection to RCE; the INFUSE benchmark measures an average indirect injection attack success rate of 19.6%, with prompt hardening reducing it only to 14.3% at the cost of utility; detector score research shows achieving a 1% false negative rate requires escalating over 91.8% of inputs; and language-surface research reveals small guard models produce significant judgment drift merely due to instruction language. In addition, RAG poisoning, Agent monitoring blind spots, Anthropic's distillation defense, and self-replicating model experiments are also worth attention. The core lesson: verification must occur at real system boundaries such as file paths, retrieval indexes, and guard policies.