RESEARCH
October 2025: MCP attacks, quantization backdoors, malware past Gmail's filter
October 2025 puts AI agents to the test: a benchmark measures twelve attacks through the Model Context Protocol, while quantization alone is enough to hide a backdoor in a model. Thirteen bytes send malware down the wrong path in Gmail's filter. The month also brings model signing on GPUs, LLMs against malicious npm updates and amplification through transparent DNS forwarders.
Archive: reconstruction written in November 2026
1. MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
arXiv · Dongsen Zhang, Zekun Li, Xu Luo, Xuannan Liu et al.
In short: MSB measures how nine LLM agents withstand twelve attacks delivered through MCP tools.
The Model Context Protocol standardises how agents discover and call external tools, but widens the attack surface. MSB classifies twelve attacks, from name collisions to instructions hidden in tool descriptions, and runs them with real tools: 2,000 cases across nine agents, 10 domains and 405 tools. The most capable models turn out to be the most vulnerable.
Why it matters. Every tool connected to an agent is an entry point: MCP adopters should treat tool catalogues and descriptions as third-party code.
Read the paper · PDF · Code
2. Rounding-Guided Backdoor Injection in Deep Learning Model Quantization
arXiv · Xiangxiang Chen, Peixin Zhang, Jun Sun, Wenhai Wang et al. · AI & LLM Security
In short: QuRA plants a backdoor in a model purely by choosing how weights are rounded during quantization.
Quantization compresses models so they run on constrained devices. QuRA poisons neither data nor training: it selects critical weights and optimises their rounding direction, amplifying the backdoor across layers without losing accuracy. It reaches close to 100% attack success in most cases and adapts to bypass existing backdoor defences.
Why it matters. A clean model can turn malicious at the compression step: anyone using third-party quantized versions inherits a risk that is hard to see.
Read the paper · PDF · Code
3. Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks
ACM Conference on Computer and Communications Security · Milad Nasr, Yanick Fratantonio, Luca Invernizzi, Ange Albertini et al. · Malware & Threat Intelligence
In short: Changing 13 bytes lets malware fool the model that routes Gmail attachments in 90% of cases.
Gmail's anti-malware pipeline uses Magika, an open-source model that identifies file types and routes each sample to a specialised classifier. Adversarial examples that fool Magika send malware to the wrong detector: changing 13 bytes evades it in 90% of cases. The proposed defence, now in production, cuts success to 20% even with 50 bytes.
Why it matters. A single machine-learning component can open a hole in the whole defence system: adversarial testing must cover the full chain.
4. Sentry: Authenticating Machine Learning Artifacts on the Fly
ACM Conference on Computer and Communications Security · Andrew Gan, Zahra Ghodsi · Post-Quantum Cryptography
In short: Sentry signs and verifies datasets and models directly on the GPU as they are loaded.
Machine-learning systems depend on datasets and models downloaded from third parties, which can be poisoned before delivery. Hashes and signatures would help but are too heavy for artefacts this large and do not work on GPUs. Sentry ties signatures to developer identities and verifies artefacts as they enter GPU memory, using accelerated Merkle trees.
Why it matters. Verifying the provenance of models and data is the first control against attacks on the AI supply chain.
5. Evaluating LLM-Based Detection of Malicious Package Updates in npm
Research in Attacks, Intrusions and Defenses · Elizabeth Wyss, Dominic Tassio, Lorenzo De Carli, Drew Davidson · Software Supply Chain
In short: With the right pre- and post-processing, an LLM flags all 209 malicious npm updates in the test set.
Compromising an npm package update lets attackers ship malware to developers and end users. The authors evaluate LLMs as detectors: they trim the code before handing it to the model and interpret the outputs to classify them. The approach works at full registry scale, and the best model flags 209 of 209 historical malicious samples.
Why it matters. Package-update attacks hit many companies at once: an effective automated filter reduces accumulation risk.
6. Forward to Hell? On the Potentials of Misusing Transparent DNS Forwarders in Reflective Amplification Attacks
ACM Conference on Computer and Communications Security · Maynard Koch, Florian Dolzmann, Thomas C. Schmidt, Matthias Wählisch · Network Security
In short: Transparent DNS forwarders turn large public resolvers into amplifiers for DDoS attacks.
Transparent DNS forwarders pass requests to open recursive resolvers without rewriting the source address. Large anycast resolvers thus take part, unwillingly, in reflective amplification attacks. The forwarders circumvent rate limiting, scale up to 14 times through anycast and help bypass the firewall rules that shield recursive resolvers.
Why it matters. A widespread, overlooked network component fuels large-scale DDoS: outages hit many customers at once.
7. Active Attack Resilience in 5G: A New Take on Authentication and Key Agreement
Research in Attacks, Intrusions and Defenses · Nazatul Haque Sultan, Xinlong Guan, Josef Pieprzyk, Wei Ni et al. · Network Security
In short: A 5G-AKA variant without sequence numbers and with forward secrecy, compatible with today's SIMs.
5G-AKA, the 5G authentication protocol, protects against passive attackers but is exposed to active ones. It relies on sequence numbers that must stay in sync and lacks forward secrecy: if long-term keys leak, past traffic is exposed. The authors propose a stateless version, compatible with existing SIM cards and networks, then extend it with forward secrecy.
Why it matters. 5G increasingly carries critical infrastructure: stronger authentication cuts the risk of interception and identity theft on the network.
8. DPA-Style Attacks on HQC
IACR Transactions on Cryptographic Hardware and Embedded Systems · Zhuo Huang, Weijia Wang, Xiaogang Zhou, Yu Yu · Post-Quantum Cryptography
In short: Fifty power traces are enough to pull the key of HQC, the new post-quantum standard, off a microcontroller.
HQC is the fifth post-quantum algorithm chosen by NIST and the only code-based one. Known power analyses need few traces but tolerate little noise. The authors build a chosen-ciphertext DPA-style attack: on an STM32F4 they recover the key with 50 traces, 20 with profiling, and about 3,000 even when the implementation is masked.
Why it matters. Post-quantum algorithms need side-channel protection before they reach devices and smart cards.
9. OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs
ACM Conference on Computer and Communications Security · Ahmed Aly, Essam Mansour, Amr Youssef · AI for Security
In short: OCR-APT spots APT intrusions in system logs and an LLM rebuilds the story in plain language.
Systems that hunt for anomalies in log provenance graphs produce many false positives and vague alerts, partly because they rely on fragile attributes such as paths and IPs. OCR-APT uses graph neural networks to learn behaviour around nodes, then an LLM rebuilds the attack stage by stage, validating each step. It beats the state of the art on DARPA TC3, OpTC and NODLINK.
Why it matters. A clear account of the intrusion speeds up response and damage reconstruction, two drivers of a claim's cost.
10. Your Microphone Array Retains Your Identity: A Robust Voice Liveness Detection System for Smart Speakers
USENIX Security Symposium · Yan Meng, Jiachun Li, Matthew Pillari, Arjun Deopujari et al. · Identity & Authentication
In short: A smart speaker's microphone array tells a live voice from a replay with 99.84% accuracy.
Smart speakers are exposed to replayed or synthetic voice attacks. Passive liveness detection uses only the captured audio, but degrades when the environment changes and requires fixed postures. ArrayID uses the circular microphone layout as a fingerprint robust to user movement: on 32,780 samples and 14 spoofing devices it reaches 99.84% accuracy.
Why it matters. As voice is increasingly used to authorise purchases and home commands, telling a person from a recording reduces fraud.
Trends of the month
AI & LLM Security
389 papers this month on this topic
With 389 of 1,883 papers, AI security remains the top topic. The month shows three weak points across a model's life: tools wired to agents through MCP, the compression step that can hide a backdoor, and the single machine-learning component that, once fooled, opens a hole in an anti-malware system used by billions.
Papers cited:
- MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
- Rounding-Guided Backdoor Injection in Deep Learning Model Quantization
- Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks
Software Supply Chain
18 papers this month on this topic
Two practical answers on the supply chain. Sentry brings signing and verification into the GPU, so third-party models and datasets are checked as they load, and a well-configured LLM recognises every malicious npm update in a historical set. Both controls act before a compromised component reaches many companies at once.
Papers cited:
- Sentry: Authenticating Machine Learning Artifacts on the Fly
- Evaluating LLM-Based Detection of Malicious Package Updates in npm
Network Security
38 papers this month on this topic
Two papers concern shared network infrastructure. Transparent DNS forwarders bypass the limits of large public resolvers and multiply the force of DDoS attacks, while a revision of 5G authentication removes the reliance on sequence numbers and adds forward secrecy without changing SIM cards.
Papers cited:
- Forward to Hell? On the Potentials of Misusing Transparent DNS Forwarders in Reflective Amplification Attacks
- Active Attack Resilience in 5G: A New Take on Authentication and Key Agreement
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1883.