\relax 
\providecommand\hyper@newdestlabel[2]{}
\providecommand\HyField@AuxAddToFields[1]{}
\providecommand\HyField@AuxAddToCoFields[2]{}
\citation{mcp-spec}
\citation{mcp-adoption}
\citation{atr-scan}
\citation{cve-list}
\citation{docker-cves}
\citation{k8s-cves}
\@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{2}{section.1}\protected@file@percent }
\newlabel{sec:introduction}{{1}{2}{Introduction}{section.1}{}}
\citation{mcp-spec}
\citation{sandworm}
\citation{postmark}
\citation{antiy-cert}
\citation{mcp-spec}
\@writefile{toc}{\contentsline {section}{\numberline {2}Background}{3}{section.2}\protected@file@percent }
\newlabel{sec:background}{{2}{3}{Background}{section.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}MCP Architecture}{3}{subsection.2.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Trust Model}{3}{subsection.2.2}\protected@file@percent }
\citation{mcp-spec}
\citation{mcp-spec}
\citation{cve-2025-6514}
\citation{jfrog-mcp}
\citation{cve-2025-53773}
\citation{cve-2025-68143}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}The Authentication Question}{4}{subsection.2.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}CVE Analysis}{4}{section.3}\protected@file@percent }
\newlabel{sec:cve-analysis}{{3}{4}{CVE Analysis}{section.3}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.1}CVE-2025-6514: mcp-remote RCE (CVSS 9.6)}{4}{subsection.3.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2}CVE-2025-53773: GitHub Copilot YOLO Mode RCE}{4}{subsection.3.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3}CVE-2025-68143/44/45: Anthropic Git MCP RCE Chain}{4}{subsection.3.3}\protected@file@percent }
\citation{cve-2025-49596}
\citation{cve-2025-59536}
\@writefile{lot}{\contentsline {table}{\numberline {1}{\ignorespaces Selected MCP-Related CVEs (February--April 2025)}}{5}{table.1}\protected@file@percent }
\newlabel{tab:cves}{{1}{5}{Selected MCP-Related CVEs (February--April 2025)}{table.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.4}CVE-2025-49596: MCP Inspector Drive-By (CVSS 9.4)}{5}{subsection.3.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.5}CVE-2025-59536: Claude Code Context Poisoning}{5}{subsection.3.5}\protected@file@percent }
\citation{atr-scan}
\citation{cve-2025-49596}
\citation{postmark}
\citation{sandworm}
\citation{cve-2025-53773}
\citation{invariant-mcp}
\citation{antiy-cert}
\citation{postmark}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.6}Cross-Cutting Patterns}{6}{subsection.3.6}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Attack Taxonomy}{6}{section.4}\protected@file@percent }
\newlabel{sec:taxonomy}{{4}{6}{Attack Taxonomy}{section.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Class 1: Tool Description Poisoning}{6}{subsection.4.1}\protected@file@percent }
\@writefile{lol}{\contentsline {lstlisting}{\numberline {1}Simplified tool description poisoning example}{6}{lstlisting.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Class 2: Response Poisoning}{6}{subsection.4.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Class 3: Rug-Pull Attacks}{6}{subsection.4.3}\protected@file@percent }
\citation{sandworm}
\citation{invariant-mcp}
\citation{antiy-cert}
\citation{atr-project}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Class 4: Typosquatting -- The SANDWORM\_MODE Campaign}{7}{subsection.4.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.5}Class 5: Cross-Skill Chaining}{7}{subsection.4.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.6}Class 6: Protocol-Level Abuse}{7}{subsection.4.6}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.7}Class 7: Credential Harvesting at Scale}{7}{subsection.4.7}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {5}Ecosystem Measurement}{7}{section.5}\protected@file@percent }
\newlabel{sec:ecosystem}{{5}{7}{Ecosystem Measurement}{section.5}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.1}Methodology}{7}{subsection.5.1}\protected@file@percent }
\citation{atr-benchmark}
\citation{atr-benchmark}
\citation{mcp-spec}
\citation{rfc2119}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.2}Results}{8}{subsection.5.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.3}False Positive Analysis}{8}{subsection.5.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.4}Registry Comparison}{8}{subsection.5.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {6}The Authentication Gap}{8}{section.6}\protected@file@percent }
\newlabel{sec:auth-gap}{{6}{8}{The Authentication Gap}{section.6}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.1}Specification Analysis}{8}{subsection.6.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {6.2}Empirical Measurement}{8}{subsection.6.2}\protected@file@percent }
\citation{docker-security}
\citation{k8s-auth}
\citation{nvd}
\citation{rsa-2026}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.3}Comparison with Historical Precedent}{9}{subsection.6.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {7}CVE Velocity in Context}{9}{section.7}\protected@file@percent }
\newlabel{sec:velocity}{{7}{9}{CVE Velocity in Context}{section.7}{}}
\@writefile{toc}{\contentsline {section}{\numberline {8}Defense Landscape}{9}{section.8}\protected@file@percent }
\newlabel{sec:defense}{{8}{9}{Defense Landscape}{section.8}{}}
\citation{safe-mcp}
\citation{atr-project,owasp-agentic}
\citation{atr-safemcp}
\citation{cisco-atr}
\citation{owasp-agentic}
\citation{snyk-invariant}
\citation{eu-ai-act}
\@writefile{toc}{\contentsline {subsection}{\numberline {8.1}SAFE-MCP}{10}{subsection.8.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {8.2}Agent Threat Rules (ATR)}{10}{subsection.8.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {8.3}OWASP Agentic Top 10}{10}{subsection.8.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {8.4}Industry Consolidation}{10}{subsection.8.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {8.5}Regulatory Pressure}{10}{subsection.8.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {8.6}Assessment: What Works and What Does Not}{10}{subsection.8.6}\protected@file@percent }
\citation{postmark}
\citation{sandworm}
\citation{antiy-cert}
\@writefile{toc}{\contentsline {section}{\numberline {9}Real-World Incidents}{11}{section.9}\protected@file@percent }
\newlabel{sec:incidents}{{9}{11}{Real-World Incidents}{section.9}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {9.1}postmark-mcp BCC Forwarding}{11}{subsection.9.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {9.2}SANDWORM\_MODE Campaign}{11}{subsection.9.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {9.3}ClawHub Registry Poisoning}{11}{subsection.9.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {10}Recommendations}{12}{section.10}\protected@file@percent }
\newlabel{sec:recommendations}{{10}{12}{Recommendations}{section.10}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {10.1}For MCP Specification Authors}{12}{subsection.10.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {10.2}For Registry Operators}{12}{subsection.10.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {10.3}For Platform Vendors}{12}{subsection.10.3}\protected@file@percent }
\citation{atr-evasions}
\@writefile{toc}{\contentsline {subsection}{\numberline {10.4}For Enterprise Adopters}{13}{subsection.10.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {11}Limitations}{13}{section.11}\protected@file@percent }
\newlabel{sec:limitations}{{11}{13}{Limitations}{section.11}{}}
\bibcite{mcp-spec}{1}
\bibcite{mcp-adoption}{2}
\bibcite{atr-scan}{3}
\bibcite{cve-list}{4}
\@writefile{toc}{\contentsline {section}{\numberline {12}Conclusion}{14}{section.12}\protected@file@percent }
\newlabel{sec:conclusion}{{12}{14}{Conclusion}{section.12}{}}
\bibcite{docker-cves}{5}
\bibcite{k8s-cves}{6}
\bibcite{sandworm}{7}
\bibcite{postmark}{8}
\bibcite{antiy-cert}{9}
\bibcite{cve-2025-6514}{10}
\bibcite{jfrog-mcp}{11}
\bibcite{cve-2025-53773}{12}
\bibcite{cve-2025-68143}{13}
\bibcite{cve-2025-49596}{14}
\bibcite{cve-2025-59536}{15}
\bibcite{invariant-mcp}{16}
\bibcite{atr-project}{17}
\bibcite{atr-benchmark}{18}
\bibcite{atr-safemcp}{19}
\bibcite{atr-evasions}{20}
\bibcite{owasp-agentic}{21}
\bibcite{safe-mcp}{22}
\bibcite{cisco-atr}{23}
\bibcite{snyk-invariant}{24}
\bibcite{rsa-2026}{25}
\bibcite{eu-ai-act}{26}
\bibcite{rfc2119}{27}
\bibcite{docker-security}{28}
\bibcite{k8s-auth}{29}
\bibcite{nvd}{30}
\@writefile{lot}{\contentsline {table}{\numberline {2}{\ignorespaces MCP Attack Taxonomy with Real-World Instances}}{17}{table.2}\protected@file@percent }
\newlabel{tab:taxonomy}{{2}{17}{MCP Attack Taxonomy with Real-World Instances}{table.2}{}}
\@writefile{lot}{\contentsline {table}{\numberline {3}{\ignorespaces Ecosystem Scan Results: 53,577 Skills}}{18}{table.3}\protected@file@percent }
\newlabel{tab:scan-results}{{3}{18}{Ecosystem Scan Results: 53,577 Skills}{table.3}{}}
\@writefile{lot}{\contentsline {table}{\numberline {4}{\ignorespaces Authentication Requirements Across Protocols}}{18}{table.4}\protected@file@percent }
\newlabel{tab:auth-comparison}{{4}{18}{Authentication Requirements Across Protocols}{table.4}{}}
\@writefile{lot}{\contentsline {table}{\numberline {5}{\ignorespaces CVE Accumulation: First Comparable Adoption Period}}{18}{table.5}\protected@file@percent }
\newlabel{tab:velocity}{{5}{18}{CVE Accumulation: First Comparable Adoption Period}{table.5}{}}
\@writefile{lot}{\contentsline {table}{\numberline {6}{\ignorespaces Defense Coverage by Attack Class}}{18}{table.6}\protected@file@percent }
\newlabel{tab:defense-assessment}{{6}{18}{Defense Coverage by Attack Class}{table.6}{}}
\gdef \@abspage@last{18}
