Five frontier models wired to multiple MCP servers pushed credentials across trust boundaries in up to 41.3 percent of runs
AspireAI community · arXiv (Li, Sun, Wang & Zhang) - NeurIPS 2026 Evaluations and Datasets
Multi-server MCP agents create an information-flow control problem: faithfully composing individually benign read and write permissions can produce cross-boundary credential propagation as a structural side effect of workflow topology, without any malicious model behaviour. MCPHunt is presented as the first controlled benchmark isolating non-adversarial, exact-match credential propagation across multi-server MCP trust boundaries.
The methodological contribution is separating two things that look identical. Task-mandated propagation is the transfer the task actually required; policy-violating propagation is a credential included despite the model having the option to redact it. Canary-based taint tracking reduces detection to objective string matching, and an environment-controlled coverage design includes risky, benign and hard-negative conditions plus a matched alternative-value control using the same tasks with distinct synthetic credentials, which confirms that production-format credentials are not necessary for the leak to occur.
Across 3,615 main-benchmark traces from five models spanning 147 tasks and nine mechanism families, policy-violating propagation rates of 11.5 to 41.3 percent persist across all models. The propagation is pathway-specific, with a 25-fold cross-mechanism range (0.0 to 74.4 percent for GPT-5.4), concentrated in browser-mediated data flows. A prompt-mitigation study across three models drove one model to 0.3 percent, a 98 percent relative reduction, while preserving 80.5 percent utility, but effectiveness varies with instruction-following capability, which the authors argue motivates data-flow-aware defenses beyond prompting. Code, traces and the labeling pipeline are released under MIT and CC BY 4.0.
Caveat: simulated servers, and the camera-ready v2 explicitly corrects the simulated taint-guard and inter-annotator agreement claims made in v1.
https://arxiv.org/abs/2604.27819
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.