Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-07-12 · source-backed
SPELLSMITH finds taint-style flaws, untrusted input reaching dangerous sinks, make up a large share of MCP-server CVEs, are slow to get patched, and need big code changes to fix (arXiv). Its move is to rewrite tool descriptions to be security-aware so the model avoids triggering the vulnerable path, no server change required. The lesson that sticks: tool descriptions are a real security surface, not documentation.
Each link below shares sources, entities, or timing with this story.
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover CVEs, MCP; overlapping topics (code, cves, description, server, tool).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses MCP); both cover CVEs, MCP; overlapping topics (code, cves).
Claude uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude uses MCP); both cover MCP; reported by the same outlet (arxiv.org).
Anthropic released MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover CVEs, MCP; overlapping topics (cves, input, server).
Claude Code uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover MCP; reported by the same outlet (arxiv.org).
Google released MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Google released MCP); both cover CVEs, MCP; overlapping topics (flaw, server).
OX Security criticizes MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OX Security criticizes MCP); both cover CVEs, MCP; overlapping topics (cves, server).
Linked by a graph relationship (OX Security criticizes MCP); both cover CVEs, MCP; overlapping topics (cves, server).