The Envelope Layer: An Underestimated Surface of LLM Agent Defense

Summary

This paper studies the envelope layer, the channel through which malicious content enters an LLM agent, using the A2A-TIBA attack as its test vehicle. A two-by-two factorial experiment and a memory experiment measure the semantic breach rate and semantic refusal rate. Strong labels reduce the breach rate only when the envelope is authentic, and memory has a larger effect than label manipulation: success memory raises the breach rate while failure memory lowers it.

Related items

• InfoThe ADLC maturity model: 5 stages of agentic development security | Endor LabsSimilar attack · Endor Labs Blog
• HighCVE-2026-118378: Tabularis SQLite driver SQL injection through MCP describe_table toolSimilar attack · NVD/CVE Database
• InfoHeads of Security: Learned Attention Gates Improve Prompt Injection RobustnessSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-117569: Kali-GPT OS command injection in execute_tool through MCP scanner parametersSimilar attack · NVD/CVE Database
• HighCVE-2026-117567: esp-mcp OS command injection through MCP tool parametersSimilar attack · NVD/CVE Database