Text scanners miss instructions that arrive as pixels. Once a tool decodes an image, those instructions join the same MCP context as ordinary tool output.
Eric Yocam and co-authors post Agentic AI Defense: Decode-Time Provenance Binding for MCP as arXiv:2610.31974. The attack they name is cross-modal trust laundering: steganographic payloads hidden in email-signature images with least-significant-bit, discrete cosine transform, or metadata tricks sail past content filters that only read text. A decoder tool then injects the recovered string into a multi-agent MCP workflow, where later agents treat it like any other trusted tool result.
Decode-time provenance binding taints recovered content before the next tool call
The defence is a package, labelled decode-time provenance binding. At decode, the system attaches HMAC-authenticated trust labels and writes lineage into an MCP-maintained provenance ledger. Context-taint tracking follows that untrusted decoded content through subsequent agent turns. Critical tool sinks refuse calls that still carry influence from untrusted decoded material, including the case where a compromised agent substitutes a valid trusted label.
Carrier independence is the design bet. The paper argues containment should fire when content is recovered into the agent context, regardless of whether the stego used LSB, DCT, or metadata. That places the control at the MCP decode boundary rather than inside one image detector.
Evaluation uses a real MCP testbed, three steganographic carriers, and 24 adaptive payloads. The undefended pipeline shows 100% attack success. Keyword and regex defences each still permit 62.5% of attacks. The authors' mechanism reports 0% attack success, including adversarial label substitution across mediated agent boundaries.
A four-component ablation checks decode marking, cryptographic authentication, lineage tracking, and sink enforcement. Separately, an audited trusted-promotion path lifts legitimate-task completion from 67% to 100% without undoing the block on untrusted influence.
The practical reading for platform teams is that decode becomes a trust event. Whatever tool turns bytes into text must mint an untrusted mark before that string can steer mail senders, shell runners, or payment sinks. HMAC authentication stops casual label forgery; the ledger keeps lineage when the string hops between agents; sink enforcement is the last gate when an agent tries to wash the mark.
Gateway and compaction stories left a carrier-shaped hole
Frontier readers already have gateway compromise (HiddenLayer's man-in-the-model work) and compaction laundering (Pixee) on the shelf. Those pieces cover intermediaries that rewrite tool calls and serializers that flatten provenance in memory. They leave open a quieter path: the payload never looks like text until a legitimate tool decodes it.
MCP multi-agent stacks make that path sharper. Email signatures, invoice scans, and screenshot attachments are routine tool inputs. If trust resets to "tool output" after decode, scanners that only watch the user prompt become theatre. Decode-time binding is the complementary containment story: stop the recovered string at the boundary, even when the carrier keeps changing.
Public arXiv paper with a GitHub defence tree
Artefacts: arXiv:2610.31974 (abstract, HTML, PDF) and the public defence repository named in Sources. Treat licence and dependency pins as whatever the repo declares at the commit you evaluate.
The mechanism is usable as a reference design and test harness for teams already mediating MCP tool calls. Expecting a drop-in filter with no ledger, no HMAC key management, and no sink policy is still a demo glance. Production shape arrives only after you map your critical sinks, key rotation, and promotion audit trail onto the paper's four components.
Put binding beside scanners when tools decode untrusted media
Decode-time provenance binding belongs in the stack when agents fetch or render images, PDFs, or other binary carriers through MCP tools and then call privileged sinks. Keyword and regex scanners remain useful as cheap first filters; the paper's 62.5% residual success rate shows why they stay insufficient alone. Role-typed memory and gateway authenticity work still cover the threats those earlier papers name, and provenance binding stacks on top for carrier-independent decode.
The mechanism can wait if your agents never decode untrusted media into context, or if every decode path already runs in a sink that cannot call out.
Label theatre, scanner-only stacks, and promotion without audit
HMAC labels without sink enforcement become stickers an agent can talk past. Keyword and regex filters leave more than half of the paper's adaptive payloads alive. Trusted-promotion without an audit trail recreates the laundering path the mechanism exists to close. Partial ablations that drop lineage tracking or decode marking reopen influence that looks clean at the final call site.
Teams that only harden the user prompt, while tools continue to decode signature images into unmarked strings, will keep seeing "clean" transcripts with dirty side effects. Multi-agent mediation widens that gap: one agent can decode, another can call the sink, and without ledger taint the second agent inherits a forged clean history.
Mark every decode before the next privileged call
If you operate an MCP mesh that touches mail, tickets, or document tools, read 2610.31974 beside your gateway and compaction controls this week. Inventory every tool that turns bytes into text, decide which sinks are critical, and require a provenance mark plus taint check before those sinks fire. Use the public repo as a design reference, then pin your own keys and ledger.
Whether your production carriers match the paper's three stego families remains a measurement you still owe yourself.