AI 安全防護缺口：MCP 檔案系統洩漏、Copilot 遠端程式碼執行與智能體防護漏掉非英語攻擊

This digest covers AI security developments from 2026-10-11 through 2026-10-18: new arXiv research on agentic and MCP security, a real-world CVE chaining indirect prompt injection into remote code execution, and fresh Anthropic research on defending against model-extraction attacks.

🔥 Highlights

My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale — a large-scale scan found real, exploitable filesystem leaks across thousands of MCP servers.
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) — indirect prompt injection plus a path-validation quirk became arbitrary code execution.
INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems — the first benchmark putting hard numbers on how much today's guardrails actually reduce agent risk.
Language Is a Security Surface for Agent Guards — smaller guard models judge the same action differently depending only on what language the instruction was written in.
Strengthening our defenses against distillation attacks — Anthropic's concrete playbook for stopping reasoning-trace extraction at the API boundary.

arXiv (cs.CR, cs.CL)

INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems — 2026-10-14. An end-to-end benchmark with 40 realistic agent tasks and a taxonomy of 56 attack scenarios across 5 threat categories, tested on 19 LLMs over roughly 41,800 adversarial trajectories. Average attack success was 19.6% under LLM-judged evaluation (15.4% under heuristic checks); existing guard models offered limited protection, while prompt-level hardening cut average success from 58.2% to 14.3% at a utility cost. Practical value: it gives teams actual numbers to calibrate how much a guardrail really buys them in long-running agents, instead of relying on vendor claims.
My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale — 2026-10-15. Identifies "filesystem capability laundering" in MCP servers — manipulated arguments that make a tool read host files outside its declared scope — and scans 21,097 MCP servers across 9 registries. Of 4,806 triaged servers, 787 (16.4%) had filesystem capability despite being classified as non-filesystem, with 150 dynamically confirmed vulnerable instances and 13 published security advisories, including two CVEs in Anthropic's own Git MCP Server. Practical value: this is not theoretical — it produced real CVEs, and is directly actionable for anyone running third-party MCP servers.
From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection — 2026-10-14. Shows that prompt-injection detectors evaluated only as binary classifiers (Jev, two variants of Llama Prompt Guard 2, and an LLM judge) break down once the real production question becomes "allow, block, or escalate." Across 47,611 held-out examples, hitting a 1% false-negative rate required escalating more than 91.8% of inputs for every system tested, with substantial false positives. Practical value: a strong argument against trusting a single detector score in isolation — teams need an explicit escalation policy, not just a threshold.
Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems — 2026-10-15. A new data-poisoning technique for RAG that exploits the structure of the approximate HNSW index (rather than exact retrieval), using "Hub" and "Satellite" documents to dominate semantic regions of the graph. On a 2M-document Wikipedia corpus it reached over 72% retrieval success and a 31.29% attack success rate, beating prior baselines, and existing poisoning defenses failed to stop it. Practical value: directly relevant to any production RAG system built on HNSW (Faiss, Milvus, and similar) — current poisoning defenses are behind this vector.
Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming — 2026-10-14. A pipeline that edits real agent transcripts (Claude Code, Codex) to introduce a specific harm — such as an API-key leak — and tests whether "action-only" monitors (which look only at the action, not the full reasoning) catch it. Of 94 transcripts, it produced 35 attacks that slipped past the authors' own monitors across 252 runs, and 6 human-confirmed attacks also slipped past an external frontier developer's monitor. Practical value: a concrete red-teaming method for anyone operating agent-action monitors — it exposes real, not hypothetical, monitoring blind spots.
Language Is a Security Surface for Agent Guards — 2026-10-15. Tests whether guard models reviewing agent steps change their verdict based solely on the language of the user instruction, translating instructions into German, French, Turkish, Swahili, and Amharic across 1,220 labeled steps while holding everything else constant. Smaller, open-source guards shifted their verdicts well beyond normal noise — more strongly for less-common languages — while frontier guards varied far less, and English paraphrasing affected verdicts less than translation. The authors released the benchmark and 489k verdicts. Practical value: a direct warning for anyone using smaller or self-hosted guard models in multilingual products — there's a per-language risk surface that English-only evaluations miss entirely.

Simon Willison (prompt-injection tag)

Nothing substantial and new on prompt injection, jailbreaks, or agent/tool abuse since 2026-10-11. The most recent prompt-injection-tagged post predates this window, and the week's other AI-tagged posts (tool launches, a recipe post, a Claude Code review, game decompilation) don't touch LLM security.

Anthropic Engineering / Research

Strengthening our defenses against distillation attacks — 2026-10-12. Describes distillation attacks — stealing model capability by farming outputs, with particular focus on reasoning chains — and Anthropic's three-pronged response: restricting where "thinking" output can leak to, a two-stage classifier with under 0.1% false positives, and repeat-offender account bans. Extractable reasoning tokens reportedly dropped 10–100x. Practical value: essential reading for any team exposing chain-of-thought or reasoning traces via an API — it's a concrete model of what CoT leakage costs and how to mitigate it without killing visible-reasoning UX.
An update on independent evaluators — 2026-10-15. Anthropic gave METR near-employee-level access (hardware, internal systems) and expanded partnerships with groups like SecureBio and Accenture, under a three-tier access/publication model; evaluators test things like alignment faking and safeguard effectiveness. Practical value: more governance than technique, but it's a useful reference for structuring an external red-teaming program if you're building one for your own LLM application.
AI models may be capable of self-replicating without access to a datacenter — 2026-10-12. Frontier Red Team experiments show small models (9B–26B) running distributed inference on cheap consumer hardware (smart TV boxes, IoT devices), projecting that models under 30B could chain every step of self-replication by the end of 2026. Practical value: more relevant to infrastructure/edge-device threat modeling than typical app security, but it's a signal worth tracking for network monitoring and IoT hardening as a model-abuse vector.

Embrace The Red

Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) — 2026-10-13, by wunderwuzzi. CVE-2026-103572 is a path-validation bypass in GitHub Copilot inside Visual Studio and SSMS, rooted in a Win32 quirk: Windows ignores a trailing dot in a filename, so the check treats .mcp.json. as different from the protected .mcp.json file — but the write still lands on the protected file anyway (the bug sits in EditsFunctionHandler.GetEditConfirmationTypeAsync). The post shows how a misaligned agent or indirect prompt injection (for example, via content returned by an MCP server) can exploit this to register a malicious MCP server or swap the ripgrep path in settings.VisualStudio.json, leading to arbitrary command execution (PoC: launching Calculator). CVSS 8.8, rated "Important" by Microsoft, fixed in the October 13, 2026 Patch Tuesday with a GetFullPath call that normalizes the path. Practical value: a concrete example of indirect prompt injection becoming RCE when a coding agent has write access to "protected" config files, and a reminder that path allowlists need real canonicalization, not naive string comparison — security controls around agents must hold even when the agent itself is compromised or misaligned.

OWASP LLM Top 10 / GenAI Security Project

Nothing new since 2026-10-11. The most recent post remains the Q3 2026 exploit roundup from earlier in October; no new technical content has been published on genai.owasp.org in this window.

NVIDIA / guardrail tooling blogs

Nothing new and relevant since 2026-10-11. This week's NVIDIA Developer blog posts covered RTX Spark, Nemotron 3.5 VL, Muse Spark, NeMo Gym, Spark UDFs, Run:ai open source, and ReplaySSM — none touching guardrails, agent safety, or red-teaming.

Through-line

The thread connecting this week's independent findings is that guardrails and classifiers that look solid in aggregate metrics fail quietly at the edges. INFUSE shows guard models barely dent indirect injection in agent benchmarks; the calibration-and-deferral paper shows detector scores alone can't support an allow/block decision; the MCP capability-laundering scan shows capability classification itself is wrong for one in six servers at scale; and the language-surface paper shows smaller guards silently drift on non-English input. Layer the Visual Studio Copilot RCE on top — where a path-validation check that looked correct in testing was defeated by an OS-level filename quirk — and the pattern is consistent: security controls built on top of an agent cannot assume the agent, or the check protecting it, will behave as expected. Validation has to happen at the actual system boundary — file paths, retrieval indexes, guard policy — not in the model's judgment.

What's catching your attention in agent security this week? Drop a comment below.