Agent security failures expose MCP, registries, eval harnesses

Focusing exclusively on model alignment misses the real danger: AI agent security collapses in the uninstrumented plumbing beneath the model, where smarter agents execute flawed configurations and unvetted tools faster. MCP STDIO command execution spawns host processes without input validation or allowlisting, exposing downstream agent IDEs and frameworks to immediate remote code execution. Tool-description poisoning in MCP registries subverts agent behavior through natural language alone, tricking models into exfiltrating data without triggering traditional jailbreak defenses. Agent scaffolding lacks social hierarchy awareness, enabling privilege escalation through basic social engineering, persona manipulation, or poisoned shared memory documents. Popular evaluation harnesses leak answers and environment hooks, meaning rising benchmark numbers often reflect harness exploitation rather than actual reasoning improvements. Critical visibility gaps leave teams blind, as over 60% of organizations cannot kill runaway agents mid-flight and nearly 80% rely on shared API keys, turning incident response into guesswork.