MCP flaw hits five orgs, Anthropic clouds Cowork, Qwen3.8 reasons to 99%
Every URL the pipeline pulled into ranking for this issue — primary sources plus the supporting and contradicting findings each Researcher returned. Inline citations in the issue point back here.
Sources
MCP for agent-to-agent comms may be the riskiest protocol you’ve never heard of arstechnica.com
Trust gaps in the new protocol spread malicious prompts from one agent to another.
Quoting Felix Rieseberg simonwillison.net
The “old” version of Cowork runs model inference in the cloud, executing tool calls in an Anthropic-provided VM we shipped to your computer. We added the VM for capability, safety, and security reasons - mapping in just the data you explicitly added to your session. People loved what they were able to do with Claude but didn’t love the disk, battery, and performance cost of running the VM locally. Also, people didn’t love that closing your laptop means the work stops. The “new” version of Cowor…
Qwen3.8 27B addition in words simonwillison.net
Research: Qwen3.8 27B addition in words Colin Frasier posted on Bluesky about an experiment he ran over two years ago using GPT-4o to see how well it could “compute the sum but return the answer in words” across increasingly large numbers. Here’s the chart he shared of those results: I’m confident GPT-4o didn’t cheat and use a calculator, especially since it got so many of the calculations wrong, but I was inspired to run the experiment again on local hardware (a DGX Spark) to explore the effec…
Falcon-Emirati: When an LLM Learns the Dialect, the Culture, and the Nuance huggingface.co
Falcon-Emirati, from Abu Dhabi’s TII, adapts the Falcon base model to Emirati Arabic, targeting local idioms, cultural references, and code-switching that generic Arabic LLMs flatten. The release pitches dialect-level fluency as a prerequisite for government and consumer deployments across the Gulf.
Command-line tool quickly removes Apple Intelligence from macOS 27 arstechnica.com
A new command-line utility rips Apple Intelligence components out of macOS 27 Golden Gate, freeing more than 12GB of disk space. The removal appeals to users who disabled the features but still carried the on-device models and assets Apple ships by default.
References
Unite.ai — Mohiuddin disclosure unite.ai
The same SSRF vulnerability (CVE-2026-14540 in Google’s case) appeared in completely unrelated MCP implementations across Google, JPMorgan Chase, Weaviate, France’s DINUM and the city of Tangerang — validating the researcher’s earlier prediction that the MCP framework itself encourages insecure defaults.
KnowYourAgent benchmark knowyouragent.network
82.4% of state-of-the-art LLMs executed malicious commands from peer agents that they had successfully rejected when issued by a human user — safety filters bypassed because the attack was packaged as inter-agent communication.
The Hacker News — Anthropic MCP design vuln thehackernews.com
Anthropic has characterized the RCE-prone STDIO behavior as ‘intentional,’ declining to modify the core protocol and placing the burden of sanitization on downstream developers.
Simon Willison — Stateless MCP simonwillison.net
The ‘lethal trifecta’ — private data access, exposure to untrusted content, and an exfiltration path — has no general fix; Stateless MCP (2026) reduces the attack surface versus stateful sessions but does not eliminate the trifecta.
Atlan — MCP vs A2A atlan.com
MCP is a ‘vertical’ client-server protocol over JSON-RPC connecting one model to tools; Google’s A2A is a ‘horizontal’ peer protocol with Agent Cards for discovery — they are complementary layers, not substitutes.
Cloud Security Alliance — MCP Security Crisis research note labs.cloudsecurityalliance.org
Independent scans indicate that nearly 82% of public MCP servers currently carry exploitable flaws, largely due to the protocol’s ‘authorization optional’ design; over 1,800 unauthenticated servers were exposed on the public internet in late 2025.
The Hacker News — SharedRoot disclosure thehackernews.com
Anthropic reportedly closed the vulnerability report as ‘informative’ without issuing a direct fix for the local VM configuration… Anthropic argued that the move to cloud-based sandboxing effectively neutralized the threat for most users, though researchers estimate that approximately 500,000 macOS users remained potentially exposed if they manually opted for local execution.
Pallas Security pallassecurity.com
On macOS, this VM utilizes Apple’s Virtualization framework, with local folders shared into the sandbox via a root daemon called
coworkd… a writable VirtioFS mount that exposes the entire host Mac filesystem to the guest-root user.
Airia — Simon Willison lethal trifecta analysis airia.com
The attack bypassed Anthropic’s restricted domain list by using a ‘confused environment’ approach: since the agent was permitted to communicate with Anthropic’s own API domains, researchers successfully uploaded stolen user data directly to an attacker’s Anthropic account.
TrueFoundry — enterprise security review truefoundry.com
Initial versions lacked granular role-based access controls (RBAC), offering only an organization-wide ‘on/off’ toggle… Cowork activity is often excluded from standard enterprise audit logs and compliance APIs, creating a ‘blind spot’ in corporate governance.
r/ClaudeAI — privacy policy reaction reddit.com
New policies effective in late 2026 allow Anthropic to share user data with law enforcement based on internal ‘good faith’ judgment rather than requiring a formal court order… major tech firms like Nvidia and Palantir to restrict Claude’s use to low-sensitivity tasks.
OpenHermit — Operator vs Cowork comparison openhermit.com
ChatGPT Agent Mode dominates web-specific tasks, achieving over 87% on the WebVoyager benchmark… Claude’s recent Opus 4.7 model leads in complex desktop-native tasks and software engineering, scoring above 82% on the OSWorld-Verified benchmark.
arXiv 2502.19981 — directional constraints in LLM addition arxiv.org
LLMs often default to a ‘one-digit lookahead’ heuristic, which succeeds in simple two-operand cases but fails when cascading carries emerge in multi-digit or multi-operand addition
Hugging Face — number tokenization blog huggingface.co
Qwen3 prioritizes single-digit tokenization… each digit from 0 to 9 is treated as an individual, atomic token… prevents ‘misalignment’ in arithmetic, where chunked token boundaries (like 12|3 vs 1|23) force a model to relearn place values for every numeric length
Greg Robison, Medium — ‘Elicited Reasoning or Constrained Imitation’ gregrobison.medium.com
In cases of ‘unfaithful’ reasoning, a model might correctly articulate a mathematical rule but then produce a final answer that contradicts it… a model might correctly identify 1776 as a leap year through its CoT steps but conclude the final answer is a ‘normal year’
r/ResearchML — ‘when does chain-of-thought (hurt)’ reddit.com
for non-reasoning tasks or simple arithmetic (e.g., ‘2+3’), CoT often leads to ‘overthinking,’ where models generate unnecessarily verbose responses that increase token costs by 20-80% without improving accuracy… smaller models (e.g., 7B parameters) suffer a performance hit when forced to use CoT
PMC/NIH — Fraser-style ‘Stochastic Parrot’ critique of reasoning claims pmc.ncbi.nlm.nih.gov
the internal ‘thinking’ tokens are not evidence of understanding, but rather a way for the model to traverse a decision tree shaped by reinforcement learning to find rewarded patterns
Exxact — Benchmarking Local AI Agents on NVIDIA DGX Spark exxactcorp.com
a single DGX Spark running Qwen 3.8 27B achieves between 20 and 27 tokens per second under typical workloads… peak decoding speeds exceeding 50 tok/s with SGLang + NVFP4
