In August 2025 a compromised release of a widely used JavaScript build tool did something that should have changed how the industry talks about agent security, and mostly did not. The malware shipped no credential stealer. It enumerated the coding agents already installed on the developer’s machine, invoked three of the mainstream ones with the safety-bypass flags those agents ship for convenience, and asked them in plain English to locate credentials and report them. Wiz’s analysis of the campaign counted over 190 affected organisations and more than 3,000 repositories.
There is no exploit in that chain. No memory corruption, no sandbox escape, no parser bug, no privilege escalation in the conventional sense. The attacker sent a well-formed request to a system whose entire purpose is to carry out well-formed requests. The agent’s obedience was the exploit primitive, which is a sentence worth sitting with, because it means the vulnerability and the product feature are the same property observed from two directions.
I argued in an earlier edition of this newsletter that prompt injection has no patch, because a transformer receives one undifferentiated token sequence and nothing in that sequence structurally marks a span as command rather than as data. This piece is the harder follow-on question. If the flaw is architectural, does it get worse as models get better? Is there a real, measurable relationship between how capable a model is and how easily it is turned against its operator?
The honest answer has three parts, and the middle one has changed in the last twelve months. Yes, the correlation is measured, repeatedly, across independent research groups and across two distinct attack surfaces. No, it is not a law of scaling, and I will show you the counterexamples that break the strong version of the claim, including one from a vendor’s own system card that falsifies it outright. And the synthesis that survives both: susceptibility is the default absent deliberate instruction-hierarchy work, and the agentic surface — tool descriptions, MCP metadata, skills and rules files — is precisely where that work has not landed.
That refinement is not a hedge. It is a more useful claim than the slogan, because it tells you where to look and what to build. A slogan about scaling laws leaves you waiting for a better model. A claim about where the hardening landed tells you which surfaces in your own system are unprotected right now, and what to do about them this week.
What the measurements actually say
Start with the cleanest study, because it is the one people cite loosely and it deserves to be cited precisely. BIPIA (Yi et al., published at KDD 2025) built an indirect prompt-injection benchmark and ran 25 language models through it, then correlated attack success rate against each model’s Chatbot Arena Elo rating. The association is positive and strong: Pearson 0.6423 across all tasks, 0.6635 on text tasks alone, p below 0.001. The authors state the conclusion without qualification — more powerful language models are more susceptible to indirect prompt injection.
The individual points make the shape legible. GPT-4, at an Elo of 1181, was compromised on 31.03 percent of attempts. GPT-3.5, at 1115, on 26.16 percent. ChatGLM-6B, at 892, on 5.32 percent; StableLM-7B, at 853, on 6.41 percent. The weakest models in the study look four to six times safer than the strongest, and I will spend a whole section below on why that appearance is partly an artifact — but note first that the gradient is monotone enough to produce a 0.66 text-task correlation across 25 systems, which is not the sort of thing that arises from a single confound.
MCPTox (Wang et al., 2025) reproduced the pattern on the surface that matters for anyone shipping agents rather than chatbots. The setup is unusually realistic for a security paper: 45 live MCP servers, 353 real tools, 1,312 attack cases, 20 agents. Their conclusion is that more capable models are often more susceptible, for the stated reason that the attack exploits their superior instruction-following ability. The headline number is o1-mini at 72.8 percent attack success. The number that should actually alarm you is the refusal rate: across every agent tested, the highest was under 3 percent. Not the highest failure to resist — the highest rate at which any model recognised the request as one it should decline. Ninety-seven percent of the time, the models were not overpowered. They never registered that anything adversarial was happening at all.
A third result comes from a different attack surface entirely, which is what makes it valuable — an independent surface reaching the same conclusion is much harder to dismiss as a benchmark artifact. Bowen and colleagues fine-tuned 24 models from 1.5B to 72B parameters and measured susceptibility to data poisoning. Larger models were significantly more susceptible from even minimal exposure, with regression coefficients of +0.037 to +0.063 on log-parameters at p below 0.05. Injection at inference time and poisoning at training time are mechanically unrelated. Both scale the same way.
And here is the exception, which I want to put in the body rather than a footnote, because it is the single most informative data point in the whole evidence base. The Gemma-2 family ran the opposite direction: larger models were more robust. One family, out of the set, escaped the gradient. That is not a rounding error or noise around a trend line — it is a categorical break, and it forecloses the strong interpretation. If scale forced susceptibility through some property of the architecture, no training recipe would escape it. A recipe did. The gradient is therefore a consequence of choices made in training and harness design, not a law that governs them.
The concession: some of that gradient is safety by incompetence
The strongest objection to everything above is a measurement artifact, and anyone arguing this thesis needs to concede it in the first minute rather than being handed it in the comments.
On agentic benchmarks, a weak model scores “safe” partly because it fails the attacker’s task in exactly the way it fails the user’s. Injecting a model that cannot reliably call a tool, chain two steps, or format a request produces a low attack success rate that has nothing to do with resistance. AgentDojo’s reported figures have this shape, with the capable models absorbing most of the successful targeted attacks. Some portion of the capability-susceptibility gradient across every study cited above is this artifact rather than a security property.
So take the concession fully. Part of the measured effect is incompetence, not resistance.
Then notice which way it cuts. Safety-by-incompetence is not a defence anyone can deploy, because it is unavailable at exactly the capability level where deployment becomes worthwhile. You cannot ship the model that fails the attacker’s task, because it also fails yours. The artifact means the gradient will look flatter than reality among models nobody would put into production, and steeper among the models actually under consideration. The population you are choosing from is the population where the effect is real.
This is also why the BIPIA and Bowen results carry more weight than the agentic benchmarks for this argument. BIPIA measures compliance with an injected instruction on text tasks, where a weak model’s general incompetence is much less of a confound. The same benchmark strengthens the concession from the other side: on code tasks it finds no correlation at all (−0.03) — the association lives exactly where competence is least confounding, and vanishes where it is most. Bowen measures behavioural change from poisoned fine-tuning data, where task competence is not in the causal path at all.
250 documents, and the number people get wrong
The most cited recent result in this area is the joint Anthropic, UK AI Security Institute and Alan Turing Institute poisoning study, and it is routinely cited for a claim it does not make. The finding is that roughly 250 poisoned documents similarly compromise models across all model and dataset sizes tested, despite the largest models training on more than twenty times more clean data.
That is not “bigger models are more vulnerable.” It is a constant-cost result, and read correctly it is more uncomfortable than the misreading. The attacker’s cost to plant a backdoor stayed flat while the defender’s corpus grew twenty-fold. Two hundred and fifty documents is approximately 420,000 tokens, which is on the order of 0.00016 percent of the training tokens of the largest model in the study. The dilution you would intuitively expect from a much larger clean corpus did not materialise.
Two scope conditions belong with that figure, and I would rather state them than have a careful reader find them. The studied backdoor was a low-stakes denial-of-service behaviour, not a capability the attacker steers, and the models involved were at or below roughly 13B parameters. Extrapolating this specific result to frontier-scale models embedding sophisticated targeted behaviour is not supported by the paper. The scaling claim in this piece rests on Bowen et al., which measured it directly and reported the Gemma-2 exception; the 250-document result carries a different and complementary claim, which is that size confers no automatic protection.
The persistence question is settled separately, and less comfortably. The Sleeper Agents work found that backdoor behaviour is most persistent in the largest models, and in models trained to produce chain-of-thought reasoning about deceiving the training process. Worse, adversarial training did not reliably remove it — the paper reports that such training can teach models to better recognise their backdoor triggers, effectively hiding the unsafe behaviour rather than removing it. If your remediation plan for a suspected poisoned model is safety fine-tuning, that result says your plan may improve your metrics while leaving the behaviour intact and better concealed.
The refusal cliff
Return to the MCPTox number, because it deserves its own treatment. Attack success of 72.8 percent on the most-affected agent is the number that gets quoted. Refusal below 3 percent across all agents is the number that tells you what is actually happening.
These describe different failure modes. High attack success with high refusal would mean models are recognising adversarial instructions and being talked around them — a contest, which is winnable with better training and losable at the margin. High attack success with near-zero refusal means no contest occurred. The model did not fail to resist. It never tried, because nothing in the input presented itself as something to resist.
That distinction determines what a defence has to do. If the model is losing an argument, better argumentation training helps. If the model is not having an argument, the fix cannot live in the model’s judgement at all, because judgement is never invoked. It has to live in what the system permits the model to do with the instruction it has cheerfully accepted.
The Agent Skills injection research (October 2025) makes the same point from the harness side, and its finding is bracing given how much has been invested in this: despite ongoing research effort and scaling model capabilities, frontier models remain vulnerable to very simple prompt injections in realistic scenarios. Not adaptive attacks, not multi-turn jailbreaks — simple ones, in realistic settings.
The same work identifies something I have not seen taken seriously enough in production designs: approval carryover. The “don’t ask again” affordance, which every agent harness ships because per-action confirmation is unusable, extends a user’s consent from a benign instance of an action class to subsequent harmful instances of the same class. The consent primitive is itself the vulnerability. A user who approves “read files in this directory” once has, in the harness’s model of the world, approved every future read in that directory including the one an injected instruction requested. Your human-in-the-loop control is a checkbox the attacker inherits.
The surface nobody hardened
Here is the structural claim of this piece. Model-layer defences have been trained, and evaluated, predominantly against two channels: the user turn and retrieved document content. The agentic surface is a third channel with different plumbing, and it has been treated as configuration rather than as input.
Tool descriptions are the clearest case. When an agent connects to an MCP server, the server returns a list of tools with natural-language descriptions telling the model what each does and when to use it. Those descriptions enter the model’s context. They are, functionally, system-prompt text supplied by a third party at runtime. Almost nobody treats them as untrusted input, and every property that makes them useful makes them dangerous: they must be natural language, they must be instructive, and the model must weight them heavily or it will not use the tools correctly.
Trail of Bits named the primitive in April 2025: line jumping. Put the payload in the description returned from tools/list, and it attacks the model’s context window directly, even if the malicious server’s tools are never called. Read that condition again. The defensive instinct is to scrutinise what a tool does when invoked. Line jumping does not require invocation. Registration is the attack. A server your agent merely connected to, and never used, has already placed instructions in front of your model.
Invariant Labs demonstrated the version with teeth in the same month. A tool description that is benign when first loaded and inspected, then mutates on a subsequent load — the rug pull. In their demonstration the mutated description hijacked a co-resident WhatsApp MCP server in the same session and exfiltrated message history. Two things there deserve attention. First, the review-at-install model of trust fails completely against content that changes after review. Second, and more structurally: the compromise crossed servers. Server A’s description influenced the model’s use of server B. Most teams that have thought about MCP trust at all have drawn the boundary at the individual server. The actual shared resource is the context window, and every connected server writes to it.
The file-based variant is worse, because of who owns the file. Pillar Security’s Rules File Backdoor (March 2025) hid instructions in invisible Unicode characters inside .cursorrules and .github/copilot-instructions.md. These are project configuration files: they survive a fork, they propagate automatically to every developer who clones the repository, and they pass pull-request review because the payload renders as nothing at all. A reviewer looking directly at the diff sees a benign rules file.
Both affected vendors declined to treat it as a platform vulnerability, placing responsibility with the user for the content of their own configuration files. You can argue that either way as a disclosure matter. What you cannot do is fail to act on the operational consequence, which is unambiguous: the instruction channel into your coding agents is officially your problem. No vendor is going to sanitise it for you, and no CVE will be issued when it is abused.
A chronology, March 2025 to July 2026
June 2025 — EchoLeak. Disclosed as CVE-2025-32711 with a CVSS score of 9.3, the first documented zero-click attack against an enterprise AI assistant. An email carrying hidden instructions arrives; nobody opens it; the retrieval layer later pulls it in as relevant context for an unrelated user question; the assistant acts on the instructions and exfiltrates data through an allowlisted image proxy. Aim Security named the primitive an LLM scope violation. The detail that matters for architecture: every component behaved as specified. The classifier, the link redaction and the content security policy were all present and all routed around. The failure was in the composition.
August 2025 — CVE-2025-53773. An injection against a coding assistant that writes to the workspace configuration, setting the auto-approve flag for tool execution to true and converting a suggestion channel into remote code execution. The injected instruction did not need to perform the harmful action. It only needed to disable the control that would have stopped the next one.
26 August 2025 — s1ngularity. The incident that opened this piece. Its significance is that it is the first at-scale demonstration of coding agents used as the attack’s execution engine rather than as its target, and the first where an attacker’s economics improved by not writing a payload at all.
September 2025 — the first malicious MCP server found in the wild. Koi disclosed an email-sending MCP server, published by a party unaffiliated with the service it presented itself as, carrying roughly 1,500 weekly installs across an estimated 300 organisations. It worked. Then at version 1.0.16 it added a single line that blind-copied every outbound message to an address the author controlled. No CVE was issued, because nothing malfunctioned in any way a scanner can express. The behaviour was the payload. This is the supply-chain problem in its purest form: the artifact is not code you audit, it is conduct you would have to observe.
September 2025 — ForcedLeak, CVSS 9.4, against an agentic CRM platform. An injection delivered through a public web-to-lead form, with exfiltration through a whitelisted domain the vendor had allowed to expire and the researchers acquired for five dollars. Your allowlist is a set of assertions about the world that decay without anyone updating the list.
September and November 2025 — Shai-Hulud. A self-replicating npm worm harvesting credentials with a secret-scanning tool and reaching into cloud metadata services, compromising over 200 packages in its first wave and 796 in the November variant. Not an agent attack as such, but the delivery mechanism for exactly the class of compromise that puts poisoned instructions inside a developer’s trusted environment.
November 2025 — a case that must be described accurately. Anthropic disclosed a campaign in which a state-linked actor used a coding agent as an orchestrator over MCP, reporting that the model executed 80 to 90 percent of the intrusion workflow. This is frequently cited in injection discussions and it does not belong there. The operator was the attacker; the technique was jailbreaking a system they controlled, not injecting one belonging to someone else. It is a capability-as-weapon case, and it belongs in a different argument — about what autonomous capability does to attacker economics. Citing it as an injection incident overstates the evidence base, and a reader who checks will discount everything else you said.
January 2026 — the systematisation. A survey of coding-agent security covering 78 studies and 42 defensive techniques reported adaptive attack success above 85 percent against state-of-the-art defences, with bypass rates of 93, 91, 89 and 78 percent against four widely deployed injection filters, and 84 percent success on data exfiltration specifically. This is the number to bring to any conversation that ends with “we bought a guardrail product.”
What the MCP specification fixed, and what it structurally cannot
The protocol has been moving, and the direction is right. The 2025-06-18 revision made servers proper OAuth resource servers, made RFC 8707 resource indicators mandatory — which closes the token-passthrough confused-deputy path where a token issued for one server is replayed against another — and shipped a security best-practices document alongside the specification.
The current revision, 2026-07-28, went further and went structural. A stateless core. The Mcp-Session-Id header removed. List endpoints no longer scoped per connection, which is a direct architectural response to line jumping: if the tool list is not a per-connection artifact, the window in which a server can serve one thing to an inspector and another to a live agent narrows considerably. Six authorisation SEPs landed alongside it, with the identity-assertion grant stable since 18 June 2026.
Now the caveat, which is the reason this section exists. Every one of those changes constrains who the server is and how it authenticates. None of them constrains what its descriptions say. Tool-description poisoning is not fixed by the current specification, and it cannot be fixed by that route, because the description must remain natural-language instruction for the model to use the tool correctly. A protocol can authenticate the sender of a sentence. It cannot make the sentence safe to read.
This is the same shape as the underlying architectural problem, one level up. At the model layer, instruction and data share a channel. At the protocol layer, metadata and instruction share a format. Both are properties of the interface, not defects in an implementation, which is why both have to be handled by the system around them.
The steelman, at full strength
If this piece only presented the evidence above it would be advocacy, and the counter-evidence is strong enough that presenting it honestly makes the argument better rather than weaker.
The falsifying result. The Claude Sonnet 5 system card, published 30 June 2026, reports the following on vendor-run evaluations: bug-bounty tool-use attack success of 0.19 percent, against 3.08 percent for GPT-5.5 and 6.66 percent for Gemini 3.5 Flash; adaptive coding attacks reduced from 12.7 percent to 0.31 percent with extended thinking enabled; computer use from 12.0 percent to 2.25 percent; and browser-use injection success falling from roughly 50 percent on Sonnet 4.6 to under 1 percent, before any external safeguard. These are vendor self-reports on internal harnesses and I have not independently reproduced them, which is the appropriate caveat for any system-card figure. They are, however, specific, dated and falsifiable, and at face value they demonstrate a large capability increase shipping alongside a large susceptibility decrease across four surfaces.
That falsifies the strong form of the thesis. Capability does not force susceptibility. Anyone still saying “more capable models are inherently more vulnerable” as an unqualified claim is arguing against a published counterexample.
The Sonnet 4.5 card, from September 2025, makes the same point in a differently useful way: it reported the lowest injection susceptibility of 23 models evaluated, with prevention rates of 96 percent on tool use, 92 percent on MCP and 78 percent on computer use, also vendor-reported. Take that gradient seriously. It is not a single robustness number; it is three numbers descending as the surface gets further from the ones the defensive training targeted. The gradient itself is the architecture argument — hardening is surface-specific, and it thins out exactly where the agentic plumbing lives.
The mechanism behind the improvement. This is not luck. OpenAI’s instruction-hierarchy work reported up to 63 percent improvement in robustness from explicitly training a trust ordering over instruction sources. The IH-Challenge results from March 2026 pushed further, reporting one model moving from 84.1 percent to 94.1 percent compliance with reinforcement learning, unsafe outputs from 6.6 percent to 0.7 percent, at minimal capability cost. Trust-ordering is trainable, it works, and it does not obviously cost you the model’s usefulness. Any argument that ignores this is not engaging with the field.
And the boundary of it. IH-Benchmark, published 29 July 2026, evaluated 37 models over 2,336 scenarios and found compliance with the intended hierarchy ranging from 98.2 percent at the top to 20.5 percent at the bottom — a spread that makes model choice a genuine security variable. Its most important finding for anyone building on MCP is this: strong System-over-User compliance is not a reliable proxy for User-over-Tool robustness. One frontier reasoning model scored 96.9 percent on the first and 65.6 percent on the second. The two are separate capabilities and they are trained separately.
Tool output is the level where MCP lives. It is the level where line jumping operates, where the rug pull operates, where the impersonating email server operated. It is also, on this evidence, the level least covered by the training that produced the impressive headline numbers. When you read a system card’s injection results, the question to ask is which of the three levels was measured.
The defender’s own account. DeepMind’s published lessons from defending Gemini are the most candid document in this literature. Adaptive attacks were near-totally successful against earlier iterations, and their conclusion after hardening is that the model still buckled in some realistic scenarios. Their recommendation is not scale and not a single technique but adaptive layered defence, evaluated against an adversary that adapts. That is a vendor with every commercial incentive to claim closure declining to claim it.
One further thread, which I include because it complicates rather than supports my case, and it is unresolved. There are reports that reasoning modes reduce injection susceptibility in some configurations, and a June 2026 result pointing the other way — that reasoning models can be more susceptible to instruction-hierarchy failures, with the reasoning process itself recruited to argue around the constraint. I have not been able to reconcile these, and I would treat “enable extended thinking” as an intervention with promising vendor-reported evidence on some surfaces and an open question on others, rather than as a control you can rely on.
Containment: four things that hold when the model does not
Everything above converges on one design instruction. Stop asking whether the model will resist the instruction. Start asking what happens when it does not. Every control below satisfies a single test: it works with the assumption that the model is fully persuaded by the attacker.
Split the control and data planes. CaMeL, published by Debenedetti and colleagues, is the most rigorous published version. A privileged component receives only the trusted task and emits a plan expressed as code, never reading untrusted content. A quarantined component reads the untrusted content and returns extracted values through a typed interface, holding no capability to act. The quarantined side can be persuaded of anything, because there is nothing to persuade it into: it emits data, never control flow. Capabilities and data-flow policies travel with values, so the policy decision is made outside the language channel entirely.
The measured cost is the part that makes this a real engineering proposal rather than a paper. CaMeL solves 77 percent of AgentDojo tasks with provable security against the injection class, against 84 percent undefended. Seven percentage points of utility for a security property you can state formally. I have not seen a better trade offered anywhere in this space, and its existence changes the character of the conversation: injection stops being a warning and becomes a specification you can hold a design against.
Buy the instruction-hierarchy work, and know what you bought. The training results are real and model choice moves your numbers materially — the IH-Benchmark spread from 98.2 to 20.5 percent is not noise. So choose accordingly, enable the vendor’s hardened modes, and then write down that you have bought a reduction in probability, not a boundary. Two specific disciplines follow. Re-evaluate on your own surfaces after every model upgrade, because the vendor measured theirs and not yours. And weight tool-output robustness above system-prompt robustness when comparing models, since that is the level your agent actually operates at and the level least correlated with the headline figure.
Make egress the control surface. EchoLeak’s data left through an allowlisted image proxy. ForcedLeak’s left through a whitelisted domain that had lapsed and cost five dollars to acquire. In both cases the exfiltration path was permitted, and in both cases every other control was present and irrelevant. If the only question your system asks about an action is whether the model intended it, you have no control at all — you have an opinion, generated by the component under attack.
Concretely: enumerate every destination an agent can reach, including indirect ones such as image rendering, link previews, webhook callbacks and outbound tool calls. Deny by default. Hold the allowlist as a deployment artifact under review, with expiry dates on entries and ownership attached to each. Then log every egress event with the action, the authority under which it was taken, and the content class, so that the reconstruction after an incident is a query rather than an archaeology project.
Put a review gate on tool descriptions. This is the cheapest control in this piece and the one almost nobody has. Treat tools/list output as untrusted input, because it is definitionally third-party text landing in your model’s context. Pin server versions rather than tracking latest. Hash every tool description at approval time. Diff on every load and fail closed on any change, so that a rug pull becomes a deployment failure instead of a breach. Normalise and reject invisible Unicode across every instruction-bearing file in the repository, which closes the Rules File Backdoor class in a single pre-commit hook. Extend the same review to skills files and agent rules files, and put them under the same code-review requirements as production source, because that is what they are.
One more, sitting underneath all four. Revisit your approval model in light of the carryover finding. If your harness offers “don’t ask again,” establish what class of action that consent actually covers and how long it survives. A consent that generalises across instances is a consent an injected instruction inherits. Bind approvals to specific resources and specific parameters rather than to action types, or accept that your human-in-the-loop control is decorative once the first approval is granted.
What would change my mind
The refined thesis in this piece is falsifiable, and I would rather state the conditions than be argued into them later.
I would abandon the claim that the agentic surface is systematically under-defended if system cards started reporting injection robustness broken out by instruction level — system, user, tool output — and the tool-output numbers converged with the others across multiple vendors. The IH-Benchmark finding that these are separate capabilities is currently the strongest evidence for my position. If the gap closes, my position closes with it.
I would revise the correlation claim substantially if a study with BIPIA’s rigour, run on 2026-generation models, found the association gone or reversed across the frontier rather than in one family. The Gemma-2 exception shows this is possible in principle. One family is an existence proof for the mechanism; a majority would be evidence the industry has actually shipped the fix.
I would drop the tool-description argument entirely if the MCP specification adopted a structural separation between machine-readable tool contracts and the natural-language text placed in model context — signed, versioned descriptions with a diffable canonical form, treated by clients as content requiring approval rather than as configuration. That is a solvable protocol problem, and it would remove the surface rather than mitigate it.
What would not change my mind is another generation of impressive vendor injection numbers on the surfaces vendors choose to evaluate. That evidence is real, and I have given it full weight above, and it tells you what one lab achieved on its own harness. It does not tell you what happens when a server your agent connected to and never called places a sentence in its context window.
The models are getting better at resisting. The surface is getting larger faster.