MCP security labels fail an integrity audit

An audit tracing 10,200 execution rows to 180 model-bound requests found that treatment metadata could change an MCP security grader’s attack label even when behavior stayed fixed, leading the authors to correct 58 historical ATTACK_SUCCESS or HIJACK_ATTEMPT labels. The integrity audit reports three verified protected-data transfers and one separate unauthorized-forwarding case in its locked reconstruction, and explicitly says it is not a population attack-rate estimate. Agent-security teams should inspect the grader and corpus before trusting a headline success rate; the archive’s control-plane analysis makes the same measurement boundary consequential in production.