A new method stops data leaks from AI tools with a signature

Researchers show that a tool for AI agents with a signature can cause a leak of confidential data, although its publisher is known. The tool uses MCP, the Model Context Protocol, a standard that connects AI agents to external tools. The runtime defence MCPGuard-Dynamic from Meta did not stop the attack in all trials. The new method, germline execution, gave no leak of data in 153 attack runs.

How it works

Each use of a tool runs in a new copy of a first program that holds no data. Each copy gets only the data that its destination is approved to get. Bad code can send out only the data in its copy. The method does not read or trust the code of the tool.

The numbers

• With the new method, there was no leak of data in 153 attack runs.
• With other defences and an ablation (a test with one part removed), data left in 5.9 to 74.5% of runs.
• One copy is 10 to 49 ms for a use. This is 2 to 28 times less than a start again of the tool for each use.

What is not known

The proof holds only if the copies stay in their limits and the first program holds no data. The authors did the tests. The source gives no test by other teams.

Insight: A signature now proves the maker, not the safety

In October 2026, Check Point Research found that copy apps with a signature of OpenAI or Anthropic install malware. Official MCP kits could send login secrets to an attacker. Here, a tool with a signature sends out data. Attackers use trust marks, and defenders maybe move from who made the software to the data it can see. Look for tool stores that limit the data of each tool.