\relax 
\providecommand\hyper@newdestlabel[2]{}
\providecommand\HyField@AuxAddToFields[1]{}
\providecommand\HyField@AuxAddToCoFields[2]{}
\citation{mcp2024}
\citation{cve6514,cve53773,cve68143,cve68144,cve68145,cve49596,cve59536}
\citation{invariant2025}
\citation{postmark}
\citation{sandworm}
\citation{antiy2026}
\citation{atrscan2386}
\citation{mcp2024,mcpspec}
\citation{greshake2023,cyberark2025}
\citation{cyberark2025}
\@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{1}{section.1}\protected@file@percent }
\newlabel{sec:intro}{{1}{1}{Introduction}{section.1}{}}
\@writefile{toc}{\contentsline {section}{\numberline {2}Background and Related Work}{1}{section.2}\protected@file@percent }
\newlabel{sec:background}{{2}{1}{Background and Related Work}{section.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}MCP Architecture}{1}{subsection.2.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}The Tool Poisoning Attack Surface}{1}{subsection.2.2}\protected@file@percent }
\citation{checkmarx2026}
\citation{docker2026}
\citation{antiy2026}
\citation{atrscan2386}
\citation{snyk2026}
\citation{promptsec2026}
\citation{atr,atrv111}
\citation{pint}
\citation{atrskillbench}
\citation{cisco79}
\citation{owasp_agentic}
\citation{safemcp}
\citation{antiy2026}
\citation{atr}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}Prior Ecosystem Audits}{2}{subsection.2.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.4}ATR Framework}{2}{subsection.2.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}Methodology}{2}{section.3}\protected@file@percent }
\newlabel{sec:method}{{3}{2}{Methodology}{section.3}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.1}Detection Engine}{2}{subsection.3.1}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {1}{\ignorespaces ATR rule categories and counts (v1.1.0).}}{2}{table.1}\protected@file@percent }
\newlabel{tab:categories}{{1}{2}{ATR rule categories and counts (v1.1.0)}{table.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Source Selection}{2}{subsection.3.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Scan Pipeline}{2}{subsection.3.3}\protected@file@percent }
\citation{atrskillbench}
\citation{pint}
\@writefile{lot}{\contentsline {table}{\numberline {2}{\ignorespaces Severity distribution of flagged skills ($N$=946).}}{3}{table.2}\protected@file@percent }
\newlabel{tab:severity}{{2}{3}{Severity distribution of flagged skills ($N$=946)}{table.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Performance}{3}{subsection.3.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.5}Validation: False Positive Rate}{3}{subsection.3.5}\protected@file@percent }
\newlabel{sec:validation}{{3.5}{3}{Validation: False Positive Rate}{subsection.3.5}{}}
\@writefile{toc}{\contentsline {section}{\numberline {4}Results}{3}{section.4}\protected@file@percent }
\newlabel{sec:results}{{4}{3}{Results}{section.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Aggregate Findings}{3}{subsection.4.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Source Comparison}{3}{subsection.4.2}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {3}{\ignorespaces Findings by source registry.}}{3}{table.3}\protected@file@percent }
\newlabel{tab:sources}{{3}{3}{Findings by source registry}{table.3}{}}
\@writefile{lot}{\contentsline {table}{\numberline {4}{\ignorespaces Top 5 ATR rules by hit count.}}{3}{table.4}\protected@file@percent }
\newlabel{tab:toprules}{{4}{3}{Top 5 ATR rules by hit count}{table.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Top Detection Rules}{3}{subsection.4.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Threat Cloud Submissions}{3}{subsection.4.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {5}Attack Pattern Analysis}{3}{section.5}\protected@file@percent }
\newlabel{sec:patterns}{{5}{3}{Attack Pattern Analysis}{section.5}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.1}Tool Description Poisoning}{3}{subsection.5.1}\protected@file@percent }
\newlabel{sec:poisoning}{{5.1}{3}{Tool Description Poisoning}{subsection.5.1}{}}
\citation{antiy2026}
\citation{atrscan2386}
\citation{promptsec2026}
\citation{checkmarx2026}
\citation{invariant2025}
\citation{cve6514,cve53773,cve68143,cve68144,cve68145,cve49596,cve59536}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.2}Credential Harvesting (55 Skills)}{4}{subsection.5.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.3}Delayed Activation (19 Skills)}{4}{subsection.5.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {6}Comparison with Prior Measurements}{4}{section.6}\protected@file@percent }
\newlabel{sec:comparison}{{6}{4}{Comparison with Prior Measurements}{section.6}{}}
\@writefile{toc}{\contentsline {section}{\numberline {7}Discussion}{4}{section.7}\protected@file@percent }
\newlabel{sec:discussion}{{7}{4}{Discussion}{section.7}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.1}For the MCP Specification}{4}{subsection.7.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {7.2}For Registry Operators}{4}{subsection.7.2}\protected@file@percent }
\citation{sandworm}
\citation{cisco79}
\citation{snyk2026}
\citation{pint}
\citation{atr}
\citation{antiy2026}
\@writefile{lot}{\contentsline {table}{\numberline {5}{\ignorespaces Comparison with prior MCP ecosystem security studies.}}{5}{table.5}\protected@file@percent }
\newlabel{tab:comparison}{{5}{5}{Comparison with prior MCP ecosystem security studies}{table.5}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.3}For Platform Builders}{5}{subsection.7.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {7.4}For Enterprise Security Teams}{5}{subsection.7.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {8}Limitations}{5}{section.8}\protected@file@percent }
\newlabel{sec:limitations}{{8}{5}{Limitations}{section.8}{}}
\@writefile{toc}{\contentsline {section}{\numberline {9}Ethics and Responsible Disclosure}{5}{section.9}\protected@file@percent }
\newlabel{sec:ethics}{{9}{5}{Ethics and Responsible Disclosure}{section.9}{}}
\citation{atr}
\bibstyle{plain}
\bibcite{mcp2024}{1}
\bibcite{mcpspec}{2}
\bibcite{atr}{3}
\bibcite{atrv111}{4}
\bibcite{atrscan2386}{5}
\bibcite{atrskillbench}{6}
\bibcite{pint}{7}
\bibcite{owasp_agentic}{8}
\bibcite{owaspllm}{9}
\bibcite{safemcp}{10}
\bibcite{cisco79}{11}
\bibcite{cve6514}{12}
\bibcite{cve53773}{13}
\bibcite{cve68143}{14}
\bibcite{cve68144}{15}
\bibcite{cve68145}{16}
\bibcite{cve49596}{17}
\bibcite{cve59536}{18}
\@writefile{toc}{\contentsline {section}{\numberline {10}Conclusion}{6}{section.10}\protected@file@percent }
\newlabel{sec:conclusion}{{10}{6}{Conclusion}{section.10}{}}
\bibcite{postmark}{19}
\bibcite{sandworm}{20}
\bibcite{invariant2025}{21}
\bibcite{antiy2026}{22}
\bibcite{checkmarx2026}{23}
\bibcite{snyk2026}{24}
\bibcite{promptsec2026}{25}
\bibcite{docker2026}{26}
\bibcite{cyberark2025}{27}
\bibcite{greshake2023}{28}
\bibcite{ohm2020}{29}
\bibcite{ladisa2023}{30}
\bibcite{promptinjsurvey}{31}
\bibcite{nist2026}{32}
\gdef \@abspage@last{7}
