synodic-ai AI SECURITY
AI Security Desk · Agent Security

Approval Is Not a Boundary: Laundered File Access in MCP Servers and Agent Guards That Move With the Wording

2026-10-16

Agent security today leans on a checkpoint at the tool call: a client approves the call, or a step-level guard rules on it. Three papers posted to arXiv on 2026-10-15 show that checkpoint leaking from both sides, with approved calls carrying far more host access than their declared contracts and guards whose verdicts shift with the language of the request and with incidental formatting in the data used to evaluate them.

What a tool-call approval actually grants

The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. An MCP server exposes each tool through a declared contract: a name, a description and an argument schema. Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun and Pengzhou He point out that in typical local deployments, client-side approval of a tool call does not restrict the server to the declared operation. It grants the underlying server process broad permissions on the host filesystem.

The authors name the resulting vulnerability class filesystem capability laundering: attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. They analyze the gap at three layers: screening by server category (L1), analysis of each tool's contract (L2), and path-validation checks that can be bypassed (L3). Their system, MCP-FSD, catalogs MCP servers, infers a least-privilege boundary for each tool, plants credential fixtures outside those boundaries, and uses paired dynamic execution to test both exploitability and whether a sandbox contains the access.

The scale of the gap

Across 21,097 MCP servers drawn from nine registries, 787 of the 4,806 servers the authors triaged, or 16.4%, exhibit filesystem capabilities despite being classified as having non-filesystem functions. Dynamic three-case validation confirmed 150 vulnerable instances under the sandbox policies tested. Coordinated disclosure produced 13 security advisories, including two CVEs in a Git MCP server.

The figure that should concern operators is the 16.4%. A tool described as doing one thing can reach files that have nothing to do with that thing, and the approval a user gives is an approval of the description. The planted credentials make the point concrete: the measure of exposure is whether a secret outside the tool's purpose can be read, not whether the tool's stated function is benign.

Guards whose verdicts depend on the request's language

The second line of defense is the step-level guard, which decides before each tool call whether the agent's next action is safe given the user's request and the trajectory so far. Hasan Demirkiran and Jens Ernstberger observe that users write requests in many languages, while guard prompts and the benchmarks used to train and evaluate purpose-built guards are in English. Their LinguaGuardBench takes the 1,220 labeled steps of TS-Bench AgentDojo-Traj and translates only the user instruction into German, French, Turkish, Swahili and Amharic, keeping every tool call, observation and label byte-identical, so any change in verdict is attributable to language alone. Six English rewordings and a whitespace placebo serve as controls, and managed guards are run three times to measure their noise.

Across 19 guards, ranging from frontier APIs to 4B-parameter open models and including four purpose-built agent guards, most open, small and purpose-built guards change verdicts under translation by more than their own noise floor. The effect grows as the language becomes rarer: among the nine guards below 13B parameters, the mean placebo-adjusted flip rate rises from +1.5 percentage points on French to +4.4 on Amharic. Purpose-built guards are the most sensitive. The direction of the damage tends to follow size. Open guards of 12B to 30B parameters block more benign steps, with false positives up by as much as 5.0 points, while every significant loss of recall occurs in a guard below 10B, by as much as 7.4 points. Frontier guards shift by at most about one point.

The damage is concentrated in a few instructions. A post-hoc analysis finds it falls on steps where the agent's reasoning restates the English request, which the authors read as guards reacting to inconsistency between channels. English paraphrase moves every guard less than translation does. The benchmark and all 489,000 verdicts are released.

Guards graded on shortcuts

In a companion paper the same authors ask whether guard evaluations measure what they claim. Evaluation data can carry cues that make labels predictable without measuring the intended safety construct, and those cues can also sway guard decisions. Their three-level shortcut audit separates label predictability, observational association between cues and guard decisions, and paired decision sensitivity, and they apply it to completed LinuxArena trajectories and two step datasets derived from TS-Bench.

The cues are strong. In LinuxArena, shorter average shell commands strongly predict trajectory labels. In AgentDojo-Traj, a lookup on the exact tool scores an F1 of .901 with mixed-domain folds but falls to .495 under domain holdout. In AgentHarm-Traj, a released purpose-built guard's F1 falls from .902 under row weighting to .719 when interactions are weighted equally, while its balanced accuracy rises.

A paired experiment then tests the strongest marker associated with safe rows, using a seven-configuration screen on a frozen 64-step AgentDojo-Traj cohort and repeated, interleaved calls to one hosted guard model. Rewriting the <INFORMATION> marker lowers blocking by 8.33 percentage points; replacing tool names with opaque aliases raises it by 11.46 points. All unsafe calls stay blocked, so the changes are in false positives against the inherited labels, and both effects remain nonzero after subtracting a formatting placebo. The effects did not reproduce in the two other guards the authors tested. Their recommendations are domain group holdouts, metrics computed per evaluation unit, and placebo-controlled paired interventions.

One checkpoint, two failure modes

Approval-based agent security rests on two assumptions: that what is approved is what the declared contract says, and that a guard's verdict is a function of the action. The MCP study measures the first assumption failing in one server in six of those triaged. The guard studies measure the second failing under translation of the request and under formatting changes that leave the action untouched, and they show that the reported accuracy of a guard can itself be an artifact of how the evaluation data is laid out.

The failures compound. A guard that reviews a tool call reviews its arguments against the tool's declared purpose; if the server can reach far beyond that purpose, a correct verdict on the stated operation still leaves the host exposed. Containment has to be enforced below the approval, and guard quality has to be measured on data that cannot be passed by shortcuts.

What operators should change

The three papers lead to controls that can be put in place without waiting for protocol changes.

Sources