Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-10 · high
Researchers built a five-layer MCP stack after pulling private keys out of a live agent framework in under five minutes with a poisoned email.
Why now: MCP tool-calling agents are increasingly plugged into email and file systems, the same access path this paper's exploit used to grab the keys in the first place.
A poisoned email pulled private keys out of a widely used AI agent framework in under five minutes, per a new paper.
The keys sat in software storage the agent could read directly. That's the exposure facing any MCP-connected agent with email or file access. A single crafted message can talk it into handing over secrets it's supposed to guard.
The paper's fix is a five-layer zero-trust MCP stack. It ends in a hardware execution boundary, an HSM, TPM, or smart card, that never releases the key itself. The agent gets back an opaque result handle instead, enough to prove an operation ran without holding material that could be exfiltrated.
Tested across four models and 12 injection scenarios, 192 runs in total, the exfiltration success rate dropped from 19.3% to zero. Benign requests still went through with no false positives.
Injection filters treat the symptom. Handle, not key. That's the paper's actual rule: an agent should hold a handle to a capability, never the key material. Any MCP setup that still hands an agent raw secrets is one crafted email away from repeating this exploit.
Each link below shares sources, entities, or timing with this story.
Microsoft supports MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover MCP; reported by the same outlet (arxiv.org).
Claude Code uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover MCP; reported by the same outlet (arxiv.org).
Linked by a graph relationship (Claude Code uses MCP); both cover MCP; reported by the same outlet (arxiv.org).
Cursor uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor uses MCP); both cover MCP; reported by the same outlet (arxiv.org).
Microsoft supports MCP / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover MCP, Their; earlier MCP coverage from 2026-07-07.
Armature uses MCP / Shared entity: MCP / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Armature uses MCP); both cover MCP; overlapping topics (agent, success).
Microsoft supports MCP / Shared entity: Their / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover Their; reported by the same outlet (arxiv.org).
Claude uses MCP / Shared entity: MCP / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Claude uses MCP); both cover MCP; reported by the same outlet (arxiv.org).