Week of Jun 16–22, 2025

Simon Willison argues that an agent becomes exploitable for data theft when it combines access to private data, exposure to untrusted content, and the ability to communicate externally. He advises users to avoid combining all three, points developers to design-pattern mitigations, and argues that guardrails catching most attacks are inadequate in a security setting.

Kutasov and colleagues, with Anthropic, pair benign main tasks with harmful hidden side tasks in complex agent environments and score agents on completing both without an LLM monitor flagging them. The best sabotage agents succeeded 27% (Claude 3.7 Sonnet) and 15% (Gemini 2.5 Pro) of the time against a Claude 3.6 Sonnet monitor; the best monitor reached an AUC of 0.87.

The 2025-06-18 revision of the Model Context Protocol specification classifies MCP servers as OAuth resource servers with protected resource metadata, and requires clients to implement RFC 8707 resource indicators so malicious servers cannot obtain tokens meant for others. It also clarifies authorization security considerations and adds a security best practices page.