Labeling data PUBLIC - OK TO SHARE made Claude Sonnet 5 leak record values verbatim in all 10 test scenarios
A controlled MCP-to-A2A study (arXiv 2609.01693, 2026-09-01) drives a real host across a local MCP leg and a local A2A delegation leg, scoring one restricted decision per trial with deterministic rules and no LLM judge, across 480 trials (4 models x 3 arms x 4 repeats). The six record values are byte-identical across arms; only the header changes. Adding PUBLIC - OK TO SHARE was associated with higher verbatim egress relative to the unlabeled baseline, strongly and consistently for Claude Sonnet 5 (public-minus-unlabeled mean +0.800, all 10 scenarios, mostly through whether it relays at all), and weakly or not at all for three GPT-5.6 tiers. The confidential-versus-unlabeled contrast was floor-limited and inconclusive, so this says a permissive label invites egress, not that a confidential label fails.
↳ Follow the thread