This is pdfTeX, Version 3.141592653-2.6-1.40.29 (TeX Live 2026) (preloaded format=pdflatex 2026.3.23)  9 APR 2026 05:46
entering extended mode
 restricted \write18 enabled.
 %&-line parsing enabled.
**MCP-Attack-Surface-2026.tex
(./MCP-Attack-Surface-2026.tex
LaTeX2e <2025-11-01>
L3 programming layer <2026-01-19>
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/base/article.cls
Document Class: article 2025/01/22 v1.4n Standard LaTeX document class
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/base/size11.clo
File: size11.clo 2025/01/22 v1.4n Standard LaTeX file (size option)
)
\c@part=\count275
\c@section=\count276
\c@subsection=\count277
\c@subsubsection=\count278
\c@paragraph=\count279
\c@subparagraph=\count280
\c@figure=\count281
\c@table=\count282
\abovecaptionskip=\skip49
\belowcaptionskip=\skip50
\bibindent=\dimen148
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/base/inputenc.sty
Package: inputenc 2024/02/08 v1.3d Input encoding file
\inpenc@prehook=\toks17
\inpenc@posthook=\toks18
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/base/fontenc.sty
Package: fontenc 2025/07/18 v2.1d Standard LaTeX package
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/cite/cite.sty
LaTeX Info: Redefining \cite on input line 302.
LaTeX Info: Redefining \nocite on input line 332.
Package: cite 2015/02/27  v 5.5
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsmath/amsmath.sty
Package: amsmath 2025/07/09 v2.17z AMS math features
\@mathmargin=\skip51

For additional information on amsmath, use the `?' option.
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsmath/amstext.sty
Package: amstext 2024/11/17 v2.01 AMS text

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsmath/amsgen.sty
File: amsgen.sty 1999/11/30 v2.0 generic functions
\@emptytoks=\toks19
\ex@=\dimen149
))
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsmath/amsbsy.sty
Package: amsbsy 1999/11/29 v1.2d Bold Symbols
\pmbraise@=\dimen150
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsmath/amsopn.sty
Package: amsopn 2022/04/08 v2.04 operator names
)
\inf@bad=\count283
LaTeX Info: Redefining \frac on input line 233.
\uproot@=\count284
\leftroot@=\count285
LaTeX Info: Redefining \overline on input line 398.
LaTeX Info: Redefining \colon on input line 409.
\classnum@=\count286
\DOTSCASE@=\count287
LaTeX Info: Redefining \ldots on input line 495.
LaTeX Info: Redefining \dots on input line 498.
LaTeX Info: Redefining \cdots on input line 619.
\Mathstrutbox@=\box53
\strutbox@=\box54
LaTeX Info: Redefining \big on input line 721.
LaTeX Info: Redefining \Big on input line 722.
LaTeX Info: Redefining \bigg on input line 723.
LaTeX Info: Redefining \Bigg on input line 724.
\big@size=\dimen151
LaTeX Font Info:    Redeclaring font encoding OML on input line 742.
LaTeX Font Info:    Redeclaring font encoding OMS on input line 743.
\macc@depth=\count288
LaTeX Info: Redefining \bmod on input line 904.
LaTeX Info: Redefining \pmod on input line 909.
LaTeX Info: Redefining \smash on input line 939.
LaTeX Info: Redefining \relbar on input line 969.
LaTeX Info: Redefining \Relbar on input line 970.
\c@MaxMatrixCols=\count289
\dotsspace@=\muskip17
\c@parentequation=\count290
\dspbrk@lvl=\count291
\tag@help=\toks20
\row@=\count292
\column@=\count293
\maxfields@=\count294
\andhelp@=\toks21
\eqnshift@=\dimen152
\alignsep@=\dimen153
\tagshift@=\dimen154
\tagwidth@=\dimen155
\totwidth@=\dimen156
\lineht@=\dimen157
\@envbody=\toks22
\multlinegap=\skip52
\multlinetaggap=\skip53
\mathdisplay@stack=\toks23
LaTeX Info: Redefining \[ on input line 2950.
LaTeX Info: Redefining \] on input line 2951.
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsfonts/amssymb.sty
Package: amssymb 2013/01/14 v3.01 AMS font symbols

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsfonts/amsfonts.sty
Package: amsfonts 2013/01/14 v3.01 Basic AMSFonts support
\symAMSa=\mathgroup4
\symAMSb=\mathgroup5
LaTeX Font Info:    Redeclaring math symbol \hbar on input line 98.
LaTeX Font Info:    Overwriting math alphabet `\mathfrak' in version `bold'
(Font)                  U/euf/m/n --> U/euf/b/n on input line 106.
))
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics/graphicx.sty
Package: graphicx 2024/12/31 v1.2e Enhanced LaTeX Graphics (DPC,SPQR)

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics/keyval.sty
Package: keyval 2022/05/29 v1.15 key=value parser (DPC)
\KV@toks@=\toks24
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics/graphics.sty
Package: graphics 2024/08/06 v1.4g Standard LaTeX Graphics (DPC,SPQR)

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics/trig.sty
Package: trig 2023/12/02 v1.11 sin cos tan (DPC)
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics-cfg/graphics.cfg
File: graphics.cfg 2016/06/04 v1.11 sample graphics configuration
)
Package graphics Info: Driver file: pdftex.def on input line 106.

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics-def/pdftex.def
File: pdftex.def 2025/09/29 v1.2d Graphics/color driver for pdftex
))
\Gin@req@height=\dimen158
\Gin@req@width=\dimen159
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/url/url.sty
\Urlmuskip=\muskip18
Package: url 2013/09/16  ver 3.4  Verb mode for urls, etc.
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/hyperref/hyperref.sty
Package: hyperref 2026-01-29 v7.01p Hypertext links for LaTeX

(/usr/local/texlive/2026basic/texmf-dist/tex/generic/iftex/iftex.sty
Package: iftex 2024/12/12 v1.0g TeX engine tests
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/kvsetkeys/kvsetkeys.sty
Package: kvsetkeys 2022-10-05 v1.19 Key value parser (HO)
)
(/usr/local/texlive/2026basic/texmf-dist/tex/generic/kvdefinekeys/kvdefinekeys.
sty
Package: kvdefinekeys 2019-12-19 v1.6 Define keys (HO)
)
(/usr/local/texlive/2026basic/texmf-dist/tex/generic/pdfescape/pdfescape.sty
Package: pdfescape 2019/12/09 v1.15 Implements pdfTeX's escape features (HO)

(/usr/local/texlive/2026basic/texmf-dist/tex/generic/ltxcmds/ltxcmds.sty
Package: ltxcmds 2023-12-04 v1.26 LaTeX kernel commands for general use (HO)
)
(/usr/local/texlive/2026basic/texmf-dist/tex/generic/pdftexcmds/pdftexcmds.sty
Package: pdftexcmds 2020-06-27 v0.33 Utility functions of pdfTeX for LuaTeX (HO
)

(/usr/local/texlive/2026basic/texmf-dist/tex/generic/infwarerr/infwarerr.sty
Package: infwarerr 2019/12/03 v1.5 Providing info/warning/error messages (HO)
)
Package pdftexcmds Info: \pdf@primitive is available.
Package pdftexcmds Info: \pdf@ifprimitive is available.
Package pdftexcmds Info: \pdfdraftmode found.
)) (/usr/local/texlive/2026basic/texmf-dist/tex/latex/hycolor/hycolor.sty
Package: hycolor 2020-01-27 v1.10 Color options for hyperref/bookmark (HO)
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/hyperref/nameref.sty
Package: nameref 2026-01-29 v2.58 Cross-referencing by name of section

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/refcount/refcount.sty
Package: refcount 2019/12/15 v3.6 Data extraction from label references (HO)
)
(/usr/local/texlive/2026basic/texmf-dist/tex/generic/gettitlestring/gettitlestr
ing.sty
Package: gettitlestring 2019/12/15 v1.6 Cleanup title references (HO)

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/kvoptions/kvoptions.sty
Package: kvoptions 2022-06-15 v3.15 Key value format for package options (HO)
))
\c@section@level=\count295
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/etoolbox/etoolbox.sty
Package: etoolbox 2025/10/02 v2.5m e-TeX tools for LaTeX (JAW)
\etb@tempcnta=\count296
)
(/usr/local/texlive/2026basic/texmf-dist/tex/generic/stringenc/stringenc.sty
Package: stringenc 2019/11/29 v1.12 Convert strings between diff. encodings (HO
)
)
\@linkdim=\dimen160
\Hy@linkcounter=\count297
\Hy@pagecounter=\count298

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/hyperref/pd1enc.def
File: pd1enc.def 2026-01-29 v7.01p Hyperref: PDFDocEncoding definition (HO)
Now handling font encoding PD1 ...
... no UTF-8 mapping file for font encoding PD1
)
(/usr/local/texlive/2026basic/texmf-dist/tex/generic/intcalc/intcalc.sty
Package: intcalc 2019/12/15 v1.3 Expandable calculations with integers (HO)
)
\Hy@SavedSpaceFactor=\count299

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/hyperref/puenc.def
File: puenc.def 2026-01-29 v7.01p Hyperref: PDF Unicode definition (HO)
Now handling font encoding PU ...
... no UTF-8 mapping file for font encoding PU
)
Package hyperref Info: Hyper figures OFF on input line 4201.
Package hyperref Info: Link nesting OFF on input line 4206.
Package hyperref Info: Hyper index ON on input line 4209.
Package hyperref Info: Plain pages OFF on input line 4216.
Package hyperref Info: Backreferencing OFF on input line 4221.
Package hyperref Info: Implicit mode ON; LaTeX internals redefined.
Package hyperref Info: Bookmarks ON on input line 4468.
\c@Hy@tempcnt=\count300
LaTeX Info: Redefining \url on input line 4807.
\XeTeXLinkMargin=\dimen161

(/usr/local/texlive/2026basic/texmf-dist/tex/generic/bitset/bitset.sty
Package: bitset 2019/12/09 v1.3 Handle bit-vector datatype (HO)

(/usr/local/texlive/2026basic/texmf-dist/tex/generic/bigintcalc/bigintcalc.sty
Package: bigintcalc 2019/12/15 v1.5 Expandable calculations on big integers (HO
)
))
\Fld@menulength=\count301
\Field@Width=\dimen162
\Fld@charsize=\dimen163
Package hyperref Info: Hyper figures OFF on input line 6084.
Package hyperref Info: Link nesting OFF on input line 6089.
Package hyperref Info: Hyper index ON on input line 6092.
Package hyperref Info: backreferencing OFF on input line 6099.
Package hyperref Info: Link coloring OFF on input line 6104.
Package hyperref Info: Link coloring with OCG OFF on input line 6109.
Package hyperref Info: PDF/A mode OFF on input line 6114.
\Hy@abspage=\count302
\c@Item=\count303
\c@Hfootnote=\count304
)
Package hyperref Info: Driver (autodetected): hpdftex.
 (/usr/local/texlive/2026basic/texmf-dist/tex/latex/hyperref/hpdftex.def
File: hpdftex.def 2026-01-29 v7.01p Hyperref driver for pdfTeX
\Fld@listcount=\count305
\c@bookmark@seq@number=\count306

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/rerunfilecheck/rerunfilechec
k.sty
Package: rerunfilecheck 2025-06-21 v1.11 Rerun checks for auxiliary files (HO)

(/usr/local/texlive/2026basic/texmf-dist/tex/generic/uniquecounter/uniquecounte
r.sty
Package: uniquecounter 2019/12/15 v1.4 Provide unlimited unique counter (HO)
)
Package uniquecounter Info: New unique counter `rerunfilecheck' on input line 2
84.
)
\Hy@SectionHShift=\skip54
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/booktabs/booktabs.sty
Package: booktabs 2020/01/12 v1.61803398 Publication quality tables
\heavyrulewidth=\dimen164
\lightrulewidth=\dimen165
\cmidrulewidth=\dimen166
\belowrulesep=\dimen167
\belowbottomsep=\dimen168
\aboverulesep=\dimen169
\abovetopsep=\dimen170
\cmidrulesep=\dimen171
\cmidrulekern=\dimen172
\defaultaddspace=\dimen173
\@cmidla=\count307
\@cmidlb=\count308
\@aboverulesep=\dimen174
\@belowrulesep=\dimen175
\@thisruleclass=\count309
\@lastruleclass=\count310
\@thisrulewidth=\dimen176
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/tools/array.sty
Package: array 2025/09/25 v2.6n Tabular extension package (FMi)
\col@sep=\dimen177
\ar@mcellbox=\box55
\extrarowheight=\dimen178
\NC@list=\toks25
\extratabsurround=\skip55
\backup@length=\skip56
\ar@cellbox=\box56
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/xcolor/xcolor.sty
Package: xcolor 2024/09/29 v3.02 LaTeX color extensions (UK)

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics-cfg/color.cfg
File: color.cfg 2016/01/02 v1.6 sample color configuration
)
Package xcolor Info: Driver file: pdftex.def on input line 274.

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/graphics/mathcolor.ltx)
Package xcolor Info: Model `cmy' substituted by `cmy0' on input line 1349.
Package xcolor Info: Model `hsb' substituted by `rgb' on input line 1353.
Package xcolor Info: Model `RGB' extended on input line 1365.
Package xcolor Info: Model `HTML' substituted by `rgb' on input line 1367.
Package xcolor Info: Model `Hsb' substituted by `hsb' on input line 1368.
Package xcolor Info: Model `tHsb' substituted by `hsb' on input line 1369.
Package xcolor Info: Model `HSB' substituted by `hsb' on input line 1370.
Package xcolor Info: Model `Gray' substituted by `gray' on input line 1371.
Package xcolor Info: Model `wave' substituted by `hsb' on input line 1372.
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/listings/listings.sty
\lst@mode=\count311
\lst@gtempboxa=\box57
\lst@token=\toks26
\lst@length=\count312
\lst@currlwidth=\dimen179
\lst@column=\count313
\lst@pos=\count314
\lst@lostspace=\dimen180
\lst@width=\dimen181
\lst@newlines=\count315
\lst@lineno=\count316
\lst@maxwidth=\dimen182

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/listings/lstpatch.sty
File: lstpatch.sty 2025/11/14 1.11b (Carsten Heinz)
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/listings/lstmisc.sty
File: lstmisc.sty 2025/11/14 1.11b (Carsten Heinz)
\c@lstnumber=\count317
\lst@skipnumbers=\count318
\lst@framebox=\box58
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/listings/listings.cfg
File: listings.cfg 2025/11/14 1.11b listings configuration
))
Package: listings 2025/11/14 1.11b (Carsten Heinz)

==> First Aid for listings.sty no longer applied!
    Expected:
        2024/09/23 1.10c (Carsten Heinz)
    but found:
        2025/11/14 1.11b (Carsten Heinz)
    so I'm assuming it got fixed.
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/enumitem/enumitem.sty
Package: enumitem 2025/02/06 v3.11 Customized lists
\labelindent=\skip57
\enit@outerparindent=\dimen183
\enit@toks=\toks27
\enit@inbox=\box59
\enit@count@id=\count319
\enitdp@description=\count320
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/tools/tabularx.sty
Package: tabularx 2023/12/11 v2.12a `tabularx' package (DPC)
\TX@col@width=\dimen184
\TX@old@table=\dimen185
\TX@old@col=\dimen186
\TX@target=\dimen187
\TX@delta=\dimen188
\TX@cols=\count321
\TX@ftn=\toks28
)
Package hyperref Info: Option `colorlinks' set `true' on input line 31.


! LaTeX Error: Missing \begin{document}.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.48 .../github.com/anthropics/agent-threat-rules}
                                                  
You're in trouble here.  Try typing  <return>  to proceed.
If that doesn't work, type  X <return>  to quit.

! Too many }'s.
l.49 }
      
You've closed more groups than you opened.
Such booboos are generally harmless, so keep going.

! Too many }'s.
l.50 }
      
You've closed more groups than you opened.
Such booboos are generally harmless, so keep going.


Overfull \hbox (53.05183pt too wide) in paragraph at lines 48--51
[]\T1/cmtt/m/n/10.95 https://github.com/anthropics/agent-threat-rules
 []


Underfull \hbox (badness 10000) in paragraph at lines 48--51

 []


(/usr/local/texlive/2026basic/texmf-dist/tex/latex/l3backend/l3backend-pdftex.d
ef
File: l3backend-pdftex.def 2025-10-09 L3 backend support: PDF output (pdfTeX)
\l__color_backend_stack_int=\count322
) (./MCP-Attack-Surface-2026.aux)
\openout1 = `MCP-Attack-Surface-2026.aux'.

LaTeX Font Info:    Checking defaults for OML/cmm/m/it on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for OMS/cmsy/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for OT1/cmr/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for T1/cmr/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for TS1/cmr/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for OMX/cmex/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for U/cmr/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for PD1/pdf/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.
LaTeX Font Info:    Checking defaults for PU/pdf/m/n on input line 52.
LaTeX Font Info:    ... okay on input line 52.

(/usr/local/texlive/2026basic/texmf-dist/tex/context/base/mkii/supp-pdf.mkii
[Loading MPS to PDF converter (version 2006.09.02).]
\scratchcounter=\count323
\scratchdimen=\dimen189
\scratchbox=\box60
\nofMPsegments=\count324
\nofMParguments=\count325
\everyMPshowfont=\toks29
\MPscratchCnt=\count326
\MPscratchDim=\dimen190
\MPnumerator=\count327
\makeMPintoPDFobject=\count328
\everyMPtoPDFconversion=\toks30
)
(/usr/local/texlive/2026basic/texmf-dist/tex/latex/epstopdf-pkg/epstopdf-base.s
ty
Package: epstopdf-base 2020-01-24 v2.11 Base part for package epstopdf
Package epstopdf-base Info: Redefining graphics rule for `.eps' on input line 4
85.

(/usr/local/texlive/2026basic/texmf-dist/tex/latex/latexconfig/epstopdf-sys.cfg
File: epstopdf-sys.cfg 2010/07/13 v1.3 Configuration of (r)epstopdf for TeX Liv
e
))
Package hyperref Info: Link coloring ON on input line 52.
 (./MCP-Attack-Surface-2026.out) (./MCP-Attack-Surface-2026.out)
\@outlinefile=\write3
\openout3 = `MCP-Attack-Surface-2026.out'.

\c@lstlisting=\count329
 [1

{/usr/local/texlive/2026basic/texmf-var/fonts/map/pdftex/updmap/pdftex.map}

]
LaTeX Font Info:    Trying to load font information for U+msa on input line 54.


(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsfonts/umsa.fd
File: umsa.fd 2013/01/14 v3.01 AMS symbols A
)
LaTeX Font Info:    Trying to load font information for U+msb on input line 54.


(/usr/local/texlive/2026basic/texmf-dist/tex/latex/amsfonts/umsb.fd
File: umsb.fd 2013/01/14 v3.01 AMS symbols B
)

! LaTeX Error: Environment IEEEkeywords undefined.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.62 \begin{IEEEkeywords}
                         
Your command was ignored.
Type  I <command> <return>  to replace it with another command,
or  <return>  to continue without it.


! LaTeX Error: \begin{document} ended by \end{IEEEkeywords}.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.64 \end{IEEEkeywords}
                       
Your command was ignored.
Type  I <command> <return>  to replace it with another command,
or  <return>  to continue without it.

[2

]
Underfull \hbox (badness 1173) in paragraph at lines 76--77
\T1/cmr/m/n/10.95 spec-i-fi-ca-tion treats au-then-ti-ca-tion as an op-
 []


Underfull \hbox (badness 1199) in paragraph at lines 83--84
\T1/cmr/m/n/10.95 sults from a scan of 53,577 skills across
 []


Underfull \hbox (badness 1831) in paragraph at lines 84--85
\T1/cmr/m/n/10.95 pro-pose con-crete re-me-di-a-tion paths (Sec-
 []


Underfull \hbox (badness 2261) in paragraph at lines 98--99
\T1/cmr/m/n/10.95 in-voke (e.g., \T1/cmtt/m/n/10.95 read_file\T1/cmr/m/n/10.95 
, \T1/cmtt/m/n/10.95 query_database\T1/cmr/m/n/10.95 ,
 []

[3]
Underfull \hbox (badness 2512) in paragraph at lines 111--112
\T1/cmr/m/n/10.95 The MCP spec-i-fi-ca-tion de-fines an op-tional
 []


! LaTeX Error: Environment threeparttable undefined.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.125 \begin{threeparttable}
                            
Your command was ignored.
Type  I <command> <return>  to replace it with another command,
or  <return>  to continue without it.

! Undefined control sequence.
l.131 CVE-2025-53773 & GitHub Copilot & ---\tnote
                                                 {a} & Embrace The Red & YOL...
The control sequence at the end of the top line
of your error message was never \def'ed. If you have
misspelled it (e.g., `\hobx'), type `I' and the correct
spelling (e.g., `I\hbox'). Otherwise just continue,
and I'll forget about whatever was undefined.

! Undefined control sequence.
l.132 ...143/44/45 & Anthropic Git MCP & ---\tnote
                                                  {a} & Cyata & RCE chain & ...
The control sequence at the end of the top line
of your error message was never \def'ed. If you have
misspelled it (e.g., `\hobx'), type `I' and the correct
spelling (e.g., `I\hbox'). Otherwise just continue,
and I'll forget about whatever was undefined.

! Undefined control sequence.
l.134 CVE-2025-59536 & Claude Code & ---\tnote
                                              {a} & Check Point Research & C...
The control sequence at the end of the top line
of your error message was never \def'ed. If you have
misspelled it (e.g., `\hobx'), type `I' and the correct
spelling (e.g., `I\hbox'). Otherwise just continue,
and I'll forget about whatever was undefined.


! LaTeX Error: Environment tablenotes undefined.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.137 \begin{tablenotes}
                        
Your command was ignored.
Type  I <command> <return>  to replace it with another command,
or  <return>  to continue without it.


Overfull \hbox (203.70895pt too wide) in paragraph at lines 126--139
 [][] 
 []


! LaTeX Error: Lonely \item--perhaps a missing list environment.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.139 \item[a]
               CVSS score not assigned at time of disclosure or pending NVD ...

Try typing  <return>  to proceed.
If that doesn't work, type  X <return>  to quit.


Underfull \hbox (badness 10000) detected at line 139
[][]
 []


! LaTeX Error: \begin{table*} on input line 121 ended by \end{tablenotes}.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.140 \end{tablenotes}
                      
Your command was ignored.
Type  I <command> <return>  to replace it with another command,
or  <return>  to continue without it.


! LaTeX Error: \begin{table*} on input line 121 ended by \end{threeparttable}.

See the LaTeX manual or LaTeX Companion for explanation.
Type  H <return>  for immediate help.
 ...                                              
                                                  
l.141 \end{threeparttable}
                          
Your command was ignored.
Type  I <command> <return>  to replace it with another command,
or  <return>  to continue without it.


Underfull \hbox (badness 10000) in paragraph at lines 144--144
[]\T1/cmr/bx/n/12 CVE-2025-6514: mcp-remote
 []


Underfull \hbox (badness 10000) in paragraph at lines 160--161
\T1/cmr/m/n/10.95 Researcher Jo-hann Re-hberger (Em-brace
 []


Underfull \hbox (badness 1552) in paragraph at lines 160--161
\T1/cmr/m/n/10.95 The Red) demon-strated that GitHub Copi-
 []


Underfull \hbox (badness 8170) in paragraph at lines 160--161
\T1/cmr/m/n/10.95 lot's ``YOLO mode''---a con-fig-u-ra-tion that
 []


Underfull \hbox (badness 2293) in paragraph at lines 160--161
\T1/cmr/m/n/10.95 auto-approves tool in-vo-ca-tions with-out user
 []


Underfull \hbox (badness 10000) in paragraph at lines 172--172
[]\T1/cmr/bx/n/12 CVE-2025-68143/44/45: An-
 []

[4]
Underfull \vbox (badness 2608) has occurred while \output is active []

 [5]
Underfull \hbox (badness 1418) in paragraph at lines 208--209
\T1/cmr/m/n/10.95 di-vid-ual weak-nesses be-come crit-i-cal when
 []


Underfull \hbox (badness 1810) in paragraph at lines 218--219
\T1/cmr/m/n/10.95 closed CVEs, real-world in-ci-dents, and our
 []


Underfull \hbox (badness 10000) in paragraph at lines 230--230
[]|\T1/cmr/m/n/10.95 CVE-2025-59536;
 []


Underfull \hbox (badness 10000) in paragraph at lines 231--232
[]|\T1/cmr/m/n/10.95 Embedded in-struc-
 []


Underfull \hbox (badness 10000) in paragraph at lines 231--232
\T1/cmr/m/n/10.95 tions, cross-tool
 []


Underfull \hbox (badness 10000) in paragraph at lines 231--232
\T1/cmr/m/n/10.95 ref-er-ences, ob-fus-
 []


Underfull \hbox (badness 3525) in paragraph at lines 234--234
[]|\T1/cmr/m/n/10.95 Malicious con-tent in-jected
 []


Underfull \hbox (badness 10000) in paragraph at lines 235--235
[]|\T1/cmr/m/n/10.95 Demonstrated in
 []


Underfull \hbox (badness 10000) in paragraph at lines 235--235
\T1/cmr/m/n/10.95 MCP In-spec-tor
 []


Underfull \hbox (badness 10000) in paragraph at lines 236--237
[]|\T1/cmr/m/n/10.95 Prompt in-jec-tion
 []


Underfull \hbox (badness 10000) in paragraph at lines 236--237
\T1/cmr/m/n/10.95 pat-terns in API
 []


Underfull \hbox (badness 10000) in paragraph at lines 238--238
[]|\T1/cmr/m/n/10.95 3. Rug-Pull
 []


Overfull \hbox (6.61069pt too wide) in paragraph at lines 238--238
\T1/cmr/m/n/10.95 (Benign$\OMS/cmsy/m/n/10.95 !$\T1/cmr/m/n/10.95 Malicious)| 
 []


Underfull \hbox (badness 10000) in paragraph at lines 240--240
[]|\T1/cmr/m/n/10.95 postmark-mcp
 []


Underfull \hbox (badness 3108) in paragraph at lines 241--242
[]|\T1/cmr/m/n/10.95 Behavioral diff be-
 []


Overfull \hbox (10.75787pt too wide) in paragraph at lines 245--245
[]|\T1/cmr/m/n/10.95 SANDWORM_MODE
 []


Underfull \hbox (badness 2600) in paragraph at lines 246--247
[]|\T1/cmr/m/n/10.95 Edit dis-tance from
 []


Underfull \hbox (badness 10000) in paragraph at lines 248--248
[]|\T1/cmr/m/n/10.95 5. Cross-Skill
 []


Underfull \hbox (badness 1867) in paragraph at lines 249--249
[]|\T1/cmr/m/n/10.95 Exploiting in-ter-ac-tions be-
 []


Underfull \hbox (badness 10000) in paragraph at lines 250--250
[]|\T1/cmr/m/n/10.95 Demonstrated via
 []


Underfull \hbox (badness 10000) in paragraph at lines 250--250
\T1/cmr/m/n/10.95 CVE-2025-53773
 []


Underfull \hbox (badness 5519) in paragraph at lines 251--252
\T1/cmr/m/n/10.95 vo-ca-tion se-quences,
 []


Underfull \hbox (badness 5359) in paragraph at lines 251--252
\T1/cmr/m/n/10.95 data flow be-tween
 []


Underfull \hbox (badness 1418) in paragraph at lines 254--254
[]|\T1/cmr/m/n/10.95 Exploitation of MCP pro-
 []


Underfull \hbox (badness 10000) in paragraph at lines 254--254
\T1/cmr/m/n/10.95 to-col features---sampling,
 []


Underfull \hbox (badness 10000) in paragraph at lines 254--254
\T1/cmr/m/n/10.95 no-ti-fi-ca-tions, re-source
 []


Underfull \hbox (badness 2951) in paragraph at lines 254--254
\T1/cmr/m/n/10.95 subscriptions---for pur-poses
 []


Underfull \hbox (badness 10000) in paragraph at lines 255--255
[]|\T1/cmr/m/n/10.95 Sampling-based
 []


Underfull \hbox (badness 7649) in paragraph at lines 256--257
\T1/cmr/m/n/10.95 quests, no-ti-fi-ca-tion
 []


Underfull \hbox (badness 10000) in paragraph at lines 260--260
[]|\T1/cmr/m/n/10.95 1,184 ma-li-cious
 []


Underfull \hbox (badness 4582) in paragraph at lines 261--262
\T1/cmr/m/n/10.95 re-quests, cre-den-tial
 []

Package hyperref Info: bookmark level for unknown lstlisting defaults to 0 on i
nput line 270.

Underfull \hbox (badness 1038) in paragraph at lines 284--285
\T1/cmr/m/n/10.95 Response poi-son-ing tar-gets the re-turn path.
 []


Underfull \hbox (badness 1365) in paragraph at lines 288--289
\T1/cmr/m/n/10.95 through the tool was silently copied to an
 []

[6]
Underfull \hbox (badness 10000) in paragraph at lines 290--290
\T1/cmr/bx/n/12 SAND-WORM_MODE Cam-
 []


Underfull \hbox (badness 10000) in paragraph at lines 300--301
\T1/cmr/m/n/10.95 MCP de-fines sev-eral pro-to-col features---
 []


Underfull \hbox (badness 2119) in paragraph at lines 300--301
\T1/cmr/m/n/10.95 that can be abused be-yond their in-tended
 []


Underfull \hbox (badness 2343) in paragraph at lines 300--301
\T1/cmr/m/n/10.95 pur-pose. The sam-pling mech-a-nism al-lows
 []


Underfull \hbox (badness 1112) in paragraph at lines 300--301
\T1/cmr/m/n/10.95 by fram-ing the sam-pling re-quest to in-clude
 []

[7]
Overfull \hbox (30.06206pt too wide) in paragraph at lines 332--348
 [][] 
 []


Underfull \hbox (badness 2080) in paragraph at lines 368--369
\T1/cmr/m/n/10.95 The dif-fer-ence cor-re-lates with re-view rigor:
 []


Overfull \hbox (106.66284pt too wide) in paragraph at lines 386--398
 [][] 
 []

[8]
Underfull \hbox (badness 10000) in paragraph at lines 414--414
[]\T1/cmr/bx/n/12 Comparison with His-tor-i-cal
 []


Underfull \hbox (badness 1831) in paragraph at lines 416--417
\T1/cmr/m/n/10.95 The MCP au-then-ti-ca-tion gap mir-rors early
 []


Underfull \hbox (badness 1360) in paragraph at lines 424--425
\T1/cmr/m/n/10.95 ble [][]5[][] presents CVE counts from the NVD
 []


Overfull \hbox (96.02003pt too wide) in paragraph at lines 430--440
 [][] 
 []


Underfull \hbox (badness 1642) in paragraph at lines 459--460
\T1/cmr/m/n/10.95 ver-i-fi-ca-tion for tool de-scrip-tions cre-ate a
 []


Underfull \hbox (badness 1226) in paragraph at lines 462--463
[]\T1/cmr/m/n/10.95 We ac-knowl-edge con-found-ing fac-tors (Sec-
 []

[9]
Underfull \hbox (badness 3525) in paragraph at lines 482--483
\T1/cmr/m/n/10.95 vulnerabilities---without pre-scrib-ing de-tec-tion
 []


Underfull \hbox (badness 1137) in paragraph at lines 492--492
[]\T1/cmr/bx/n/12 Assessment: What Works and
 []


Overfull \hbox (41.81827pt too wide) in paragraph at lines 500--514
 [][] 
 []

[10]
Underfull \hbox (badness 10000) in paragraph at lines 530--531
\T1/cmr/m/n/10.95 In March 2025, ver-sion 1.0.16 of the
 []


Underfull \hbox (badness 10000) in paragraph at lines 530--531
\T1/cmtt/m/n/10.95 postmark-mcp \T1/cmr/m/n/10.95 npm package---a le-git-i-mate

 []


Underfull \hbox (badness 1533) in paragraph at lines 530--531
\T1/cmr/m/n/10.95 to an attacker-controlled ad-dress [[][]8[][]]. The
 []


Underfull \hbox (badness 1062) in paragraph at lines 532--533
\T1/cmr/m/n/10.95 was un-de-tectable by static scan-ning of tool
 []


Underfull \hbox (badness 10000) in paragraph at lines 534--534
[]\T1/cmr/bx/n/12 SANDWORM_MODE Cam-
 []

[11]
Underfull \hbox (badness 2197) in paragraph at lines 551--552
[]\T1/cmr/m/n/10.95 The ClawHub in-ci-dent demon-strates that
 []


Underfull \hbox (badness 2875) in paragraph at lines 564--565
\T1/cmr/m/n/10.95 MAY re-quire au-then-ti-ca-tion'' to ``Servers
 []


Underfull \hbox (badness 1655) in paragraph at lines 566--567
\T1/cmr/m/n/10.95 stan-dard-ized per-mis-sion model (anal-o-gous
 []

[12]
Underfull \hbox (badness 1178) in paragraph at lines 583--584
\T1/cmr/m/n/10.95 MCP server con-fig-u-ra-tions against known
 []

[13]
Underfull \hbox (badness 1082) in paragraph at lines 621--622
\T1/cmr/m/n/10.95 The Model Con-text Pro-to-col is the fastest-
 []


Underfull \hbox (badness 1466) in paragraph at lines 621--622
\T1/cmr/m/n/10.95 growing at-tack sur-face in AI in-fras-truc-ture.
 []


Underfull \hbox (badness 2158) in paragraph at lines 621--622
\T1/cmr/m/n/10.95 Thirty CVEs in 60 days is not merely a
 []


Underfull \hbox (badness 10000) in paragraph at lines 642--644
[]\T1/cmr/m/n/10.95 Anthropic, ``Model Con-text Pro-to-col
 []


Underfull \hbox (badness 10000) in paragraph at lines 642--644
\T1/cmr/m/n/10.95 Spec-i-fi-ca-tion,'' re-vi-sion 2025-03-26,
 []


Underfull \hbox (badness 10000) in paragraph at lines 642--644
[][]$\T1/cmtt/m/n/10.95 https : / / modelcontextprotocol . io /
 []


Underfull \hbox (badness 10000) in paragraph at lines 650--652
[][]$\T1/cmtt/m/n/10.95 https : / / github . com / anthropics /
 []


Underfull \hbox (badness 1668) in paragraph at lines 654--656
[]\T1/cmr/m/n/10.95 NIST, ``Na-tional Vul-ner-a-bil-ity Database:
 []

[14]
Underfull \hbox (badness 10000) in paragraph at lines 658--660
\T1/cmr/m/n/10.95 2015,'' [][]$\T1/cmtt/m/n/10.95 https : / / nvd . nist . gov 
/ vuln /
 []


Underfull \hbox (badness 4060) in paragraph at lines 658--660
\T1/cmtt/m/n/10.95 search ? keyword = docker$[][]\T1/cmr/m/n/10.95 , ac-cessed 
April
 []


Underfull \hbox (badness 1024) in paragraph at lines 662--664
[]\T1/cmr/m/n/10.95 NIST, ``NVD search: Ku-ber-netes CVEs
 []


Underfull \hbox (badness 10000) in paragraph at lines 662--664
\T1/cmtt/m/n/10.95 search ? keyword = kubernetes$[][]\T1/cmr/m/n/10.95 , ac-ces
sed
 []


Underfull \hbox (badness 10000) in paragraph at lines 666--668
[]\T1/cmr/m/n/10.95 Checkmarx Re-search, ``SAND-
 []


Underfull \hbox (badness 1975) in paragraph at lines 666--668
\T1/cmr/m/n/10.95 WORM_MODE: 19 ty-posquat-ted MCP
 []


Underfull \hbox (badness 1168) in paragraph at lines 682--684
[]\T1/cmr/m/n/10.95 S. Kan-nan and A. Yo-gev, ``MCP se-cu-
 []


Underfull \hbox (badness 2269) in paragraph at lines 690--692
[]\T1/cmr/m/n/10.95 Cyata Se-cu-rity, ``CVE-2025-68143/44/45:
 []


Underfull \hbox (badness 1231) in paragraph at lines 702--704
[]\T1/cmr/m/n/10.95 Invariant Labs, ``MCP se-cu-rity anal-y-sis:
 []


Underfull \hbox (badness 1515) in paragraph at lines 706--708
\T1/cmr/m/n/10.95 v1.1.1, 108 rules, [][]$\T1/cmtt/m/n/10.95 https : / / github
 . com /
 []


Underfull \hbox (badness 6691) in paragraph at lines 713--715
[]\T1/cmr/m/n/10.95 Agent Threat Rules Project, ``SAFE-
 []


Underfull \hbox (badness 10000) in paragraph at lines 713--715
\T1/cmr/m/n/10.95 ments (91.8%),'' [][]$\T1/cmtt/m/n/10.95 https : / / github .
 com /
 []


Underfull \hbox (badness 10000) in paragraph at lines 713--715
\T1/cmtt/m/n/10.95 anthropics / agent-[]threat-[]rules / docs /
 []


Underfull \hbox (badness 3199) in paragraph at lines 720--722
\T1/cmr/m/n/10.95 Se-cu-rity Top 10,'' [][]$\T1/cmtt/m/n/10.95 https : / / owas
p . org /
 []


Underfull \hbox (badness 3895) in paragraph at lines 724--726
[]\T1/cmr/m/n/10.95 SAFE-MCP Con-sor-tium, ``Se-cur-ing AI-
 []


Underfull \hbox (badness 1231) in paragraph at lines 732--734
[]\T1/cmr/m/n/10.95 Snyk, ``Snyk ac-quires In-vari-ant Labs to
 []

[15]
Underfull \hbox (badness 1975) in paragraph at lines 740--742
[]\T1/cmr/m/n/10.95 European Par-lia-ment, ``Reg-u-la-tion (EU)
 []


Underfull \hbox (badness 7362) in paragraph at lines 748--750
[]\T1/cmr/m/n/10.95 Docker Inc., ``Docker se-cu-rity: Pro-
 []


Underfull \hbox (badness 10000) in paragraph at lines 748--750
\T1/cmr/m/n/10.95 tect-ing the Docker dae-mon socket,''
 []


Underfull \hbox (badness 10000) in paragraph at lines 748--750
[][]$\T1/cmtt/m/n/10.95 https : / / docs . docker . com / engine /
 []


Underfull \hbox (badness 10000) in paragraph at lines 752--754
[]\T1/cmr/m/n/10.95 Kubernetes Project, ``Au-then-ti-ca-
 []


Underfull \hbox (badness 10000) in paragraph at lines 752--754
\T1/cmr/m/n/10.95 tion,'' [][]$\T1/cmtt/m/n/10.95 https : / / kubernetes . io /
 docs /
 []


Underfull \hbox (badness 10000) in paragraph at lines 752--754
\T1/cmtt/m/n/10.95 reference / access-[]authn-[]authz /
 []


Underfull \hbox (badness 4060) in paragraph at lines 756--758
[][]$\T1/cmtt/m/n/10.95 https : / / nvd . nist . gov/$[][]\T1/cmr/m/n/10.95 , a
c-cessed April
 []

! Undefined control sequence.
l.761 \balance
              
The control sequence at the end of the top line
of your error message was never \def'ed. If you have
misspelled it (e.g., `\hobx'), type `I' and the correct
spelling (e.g., `I\hbox'). Otherwise just continue,
and I'll forget about whatever was undefined.

[16

] [17] [18] (./MCP-Attack-Surface-2026.aux)
 ***********
LaTeX2e <2025-11-01>
L3 programming layer <2026-01-19>
 ***********
Package rerunfilecheck Info: File `MCP-Attack-Surface-2026.out' has not changed
.
(rerunfilecheck)             Checksum: 6042137A828E98E9437530589DD2815B;8783.
 ) 
Here is how much of TeX's memory you used:
 12832 strings out of 469006
 190842 string characters out of 5454813
 660137 words of memory out of 5000000
 41235 multiletter control sequences out of 15000+600000
 641739 words of font info for 76 fonts, out of 8000000 for 9000
 319 hyphenation exceptions out of 8191
 75i,11n,79p,1420b,1534s stack positions out of 10000i,1000n,20000p,200000b,200000s
 </Users/user/Library/texlive/2026basic/texmf-var/fonts/pk/ljfour/jknappen/ec
/ectt0800.600pk> </Users/user/Library/texlive/2026basic/texmf-var/fonts/pk/ljfo
ur/jknappen/ec/ecrm0900.600pk> </Users/user/Library/texlive/2026basic/texmf-var
/fonts/pk/ljfour/jknappen/ec/tcrm1095.600pk> </Users/user/Library/texlive/2026b
asic/texmf-var/fonts/pk/ljfour/jknappen/ec/ecti1095.600pk> </Users/user/Library
/texlive/2026basic/texmf-var/fonts/pk/ljfour/jknappen/ec/ecbx1200.600pk> </User
s/user/Library/texlive/2026basic/texmf-var/fonts/pk/ljfour/jknappen/ec/ecbx1095
.600pk> </Users/user/Library/texlive/2026basic/texmf-var/fonts/pk/ljfour/jknapp
en/ec/ecbx1440.600pk> </Users/user/Library/texlive/2026basic/texmf-var/fonts/pk
/ljfour/jknappen/ec/ecrm1200.600pk> </Users/user/Library/texlive/2026basic/texm
f-var/fonts/pk/ljfour/jknappen/ec/ecrm1728.600pk> </Users/user/Library/texlive/
2026basic/texmf-var/fonts/pk/ljfour/jknappen/ec/ecrm1095.600pk> </Users/user/Li
brary/texlive/2026basic/texmf-var/fonts/pk/ljfour/jknappen/ec/ectt1095.600pk></
usr/local/texlive/2026basic/texmf-dist/fonts/type1/public/amsfonts/cm/cmsy10.pf
b>
Output written on MCP-Attack-Surface-2026.pdf (18 pages, 211273 bytes).
PDF statistics:
 1003 PDF objects out of 1200 (max. 8388607)
 498 compressed objects within 5 object streams
 144 named destinations out of 1000 (max. 500000)
 385 words of extra memory for PDF output out of 10000 (max. 10000000)

