An audit reclassified 58 attack-success labels to benign, taking verified attacks in a locked MCP dataset to zero.

arXiv 2608.12880 did a treatment-blind reconstruction of an MCP agent security evaluation, collapsing 10,200 execution rows to 180 model-bound requests, 45 semantic requests and 15 observable stimuli. If this generalizes, a real share of the agent-security ASR figures circulating right now measure label leakage rather than compromise. Check the methodology before you cite one.