Germline Execution Blocks Data Exfiltration in Signed MCP Tools
This paper demonstrates that authenticated MCP tools can hide malicious code that leaks data, bypassing runtime defenses like Meta's MCPGuard-Dynamic. The authors introduce germline execution, which runs each tool invocation in an ephemeral copy forked from a data-free process, limiting disclosure to only authorized data. In 153 attack runs, germline execution prevented all unauthorized disclosures, while baseline defenses failed in 5.9-74.5% of runs, with invocation latency of 10-49 ms.
Why it matters: Provides a novel, proven defense against a critical security flaw in AI agent toolchains, with concrete experimental results and formal guarantees.