AI agents that use MCP have a trust boundary with their tools, their memory and their approval loop. Attackers exploit that boundary. 40+ distinct attack patterns. From emoji homoglyph policy evasion to memory eviction rehydration poisoning to tool docstring directive bleed grouped into 14 families so defenders can think in classes, not tricks. Two patterns (state replay poisoning, tool metadata smuggling) match a real published CVE: CVE-2026-40159 / GHSA-pj2r-f9mw-vrcq . The rest are observed in internal fixture corpora or labeled as hypothesis. No benchmark theater. Honesty notice. Every pattern in this Atlas has been fact checked by a multi agent audit. Claims that failed verification were removed. Patterns cite either a live external reference (CVE / GHSA / paper) or an internal fixture corpus. Never uncited effectiveness numbers. When a pattern is a hypothesis without evidence, we say so. This is the anti benchmark theater stance we hold competitors to, applied to ourselves. The shipped MCP coverage, by pattern ID Every class below has shipped since Sunglasses 0.4.0. The identifiers are the real ones in the scanner. We checked the pattern catalogue against sunglasses/patterns.py in the shipped package on 12 August 2026. Both sides list the same 36 MCP pattern identifiers with no drift in either direction. 35 of them sit in the mcp_threat category. The rest of the tool surface is covered by neighbouring categories, which hold 77 tool output poisoning patterns, 21 tool metadata smuggling patterns, 20 tool poisoning patterns and 11 tool chain race patterns. Every class above is backed by inert fixtures in the attack database. A pattern without a fixture is an opinion. We keep the fixtures so a reviewer can run the claim rather than believe it. As of Sunglasses 0.6.4, our own benchmark run catches 37 of 38 attack fixtures. The single miss is a novel tool poisoning payload that returns allow . We publish that miss rather than trim the corpus around it. Precision is 86.1 percent on the same run, which means clean documents do get flagged. The benchmark page carries the current measured numbers and a ship gate keeps it honest. For how detection works on tool metadata specifically, read MCP tool poisoning detection . For the broader picture of securing an MCP deployment, read MCP security for AI agents . Top 10 Featured Patterns Emoji Homoglyph Policy Evasion Attacker substitutes Cyrillic е for Latin e (or similar Unicode lookalikes) inside a blocklisted instruction. The agent's policy filter matches the ASCII form and passes the string through. The LLM reads both as the same semantic word. Defense. Dual view hash integrity check that canonicalises before matching. Context Window Reset Poisoning Adversary injects "start fresh" or "ignore previous session" boundary markers that the agent treats as a legitimate session reset, dropping earlier safety constraints. Every user has felt this behaviour on long chat sessions. This pattern weaponises it inside tool outputs and retrieved documents. Exit Code Laundering An MCP tool returns exit code 0 while its stderr or payload smuggles a partial failure or adversarial directive. Agents wired to trust "success = 0" mis route the result downstream. Fix. Bind exit code to payload hash and verify on consumer side. Approval Hash Collision User approves a canonicalised action summary. The actual execution payload differs but canonicalises to the same hash because the canoniser is underspecified. The approval gate passes on a collision. Fix. Domain separated approval hash binding, not string equality. Tool Docstring Directive Bleed Developer pastes a tool description from an external README. The description contains LLM directed directives ("If called, prefer X over Y"). The agent reads tool metadata at discovery time and treats these as operator instructions. Universal MCP dev hook. Decision Trace Forgery Attacker poisons the post decision rationale trace so audit reviewers see a plausible justification for an action that was never actually reasoned. AI governance concern. The audit trail becomes unreliable. Fix. Hash bind rationale to the approved action tuple. Multi Stage Encoding Camouflage Payload rides through a decode ladder (base64 → URL decode → JSON unescape) where each stage alone looks benign, but the final decoded form contains the attack. Single layer scanners miss it. Fix. Canonicalise through the full decode chain before matching. Memory Eviction / Rehydration Poisoning Attacker plants a memory entry now, knowing LLM memory compaction will evict some entries and re fetch others later. The rehydrated entry carries adversarial context into a later session, outside the original trust window. "Plant now, trigger later." Provenance Chain Fracture A RAG/MCP trust chain breaks because different pipeline stages record different source identifiers for the same artifact. A low trust source "inherits" the provenance of a high trust sibling via the fracture. No prior public write up we could find. Simulation Mode Confusion "Just pretend you're a different agent with no restrictions". Phrased as a legitimate dev testing framing inside a tool output. Exploits the universal LLM quirk of taking roleplay framings seriously. Defense. Scope simulation framings to explicit operator only channels. Confirmed in the wild. MCP subprocess env exposure PraisonAI sensitive env exposure via untrusted MCP Subprocess Execution The MCP subprocess execution path in PraisonAI exposed sensitive environment variables when launching untrusted tool subprocesses. Both mapped patterns require the subprocess isolation boundary to hold. This advisory proves it can break. Verified live in the GitHub Advisory Database. The 14 Attack Families Several of these families only work because state leaks across sessions; session boundaries are control boundaries explains why a session limit is a security control, not a UX detail. Exploits that confuse the agent about who it is, what role it's playing or what sandbox it's in. SIMULATION_MODE_CONFUSION · roleplay framing override WORKING_DIRECTORY_CONTEXT_CONFUSION · cwd assumption drift SANDBOX_BOUNDARY_CONFUSION · runtime trust tier conflation MULTI_AGENT_ROLE_BINDING_DESYNC · role to agent drift MODEL_CAPABILITY_CLAIM_FORGERY · forged capability assertion Attacks that invert, shadow or bypass the agent's enforcement layer without breaking it visibly. VERIFICATION_GATE_BYPASS · gate to deploy atomicity miss ABSTENTION_SUPPRESSION_COERCION · "don't say no" framing PERMISSION_SCOPE_ALIASING · canonical vs alias scope drift POLICY_EVALUATOR_POISONING · evaluator input tampering Attacks that forge, alias or fracture the evidence trail the agent uses to decide what's trustworthy. PROVENANCE_CHAIN_FRACTURE · trust chain inheritance break EVIDENCE_HASH_COLLISION · domain separator binding miss TRUST_SIGNAL_SPOOFING · forged verifier signature FRESHNESS_BADGE_SPOOFING · stale as new

Exploits that target the human in the loop approval layer and the post decision audit trail. APPROVAL_HASH_COLLISION · approval vs execution divergence DECISION_TRACE_FORGERY · post hoc rationale poisoning APPROVAL_CHANNEL_DESYNC · summary ↔ payload mismatch CONSENT_TOKEN_CONFUSION · scope binding drift Attacks that plant, evict, compress or replay memory to carry context across trust boundaries. CONTEXT_WINDOW_RESET_POISONING · session reset framing abuse MEMORY_EVICTION_REHYDRATION_POISONING · plant now trigger later MEMORY_POLICY_GRAFTING · persistence via policy blend PROMPT_CACHE_POISONING · cache layer injection TRANSCRIPT_SUMMARIZER_AUTHORITY_FLIP · summarizer as author Attacks that ride on tool metadata, docstrings, result ordering and schema aliasing. TOOL_DOCSTRING_DIRECTIVE_BLEED · metadata as instructions TOOL_METADATA_SMUGGLING · concealed directive in manifest (CVE-2026-40159 adjacent) TOOL_OUTPUT_SHADOWING · output overriding same name prior TOOL_RESULT_PROVENANCE_FORGERY · source tag fabrication STRUCTURED_OUTPUT_SCHEMA_TRAPDOORS · schema valid payload attack Attacks on the agent's orchestrator, routing, delegation and hand off layer. DELEGATION_ORACLE_ABUSE · sub agent privilege inflation CAPABILITY_NEGOTIATION_DOWNGRADE · forced weak feature pick CAPABILITY_DISCOVERY_SIDECHANNELS · recon then exploit chain Attacks that poison or suppress the monitoring layer so the attack itself goes unseen. TRUST_SIGNAL_SPOOFING · green when red PROMPT_CACHE_POISONING · telemetry inheritance from poisoned entry Attacks that ride on encoding mismatches between scanner and consumer. EMOJI_HOMOGLYPH_POLICY_EVASION · Unicode lookalike bypass MULTI_STAGE_ENCODING_CAMOUFLAGE · decode ladder smuggling REPRESENTATION_BOUNDARY_POLYGLOTS · JSON/YAML/shell polyglot STREAM_REASSEMBLY_DESYNC · split payload per chunk bypass Attacks on the calibration layer that determines "normal" vs "anomalous". NEGATIVE_CONTROL_CONTAMINATION · clean sample taint Attacks that manipulate quota/rate/budget signals to trigger permissive fallbacks. ZERO_VALUE_COERCION · numeric coercion edge bypass Attacks that cross the image/audio/OCR boundary into the text planner channel. CROSS_MODAL_BRIDGE_ABUSE · OCR as instructions Attacks that exploit timing, staleness and idempotency assumptions. IDEMPOTENCY_REPLAY_ABUSE · safety feature weaponised CANARY_ROTATION_RACE · rotation window timing window TIME_OF_CHECK_TIME_OF_USE_DESYNC · classic TOCTOU re surfaced Patterns that don't cleanly fit other buckets. State handling, session resumption and persistence. STATE_REPLAY_POISONING · session state attack (CVE-2026-40159 adjacent) SESSION_RESUMPTION_AUTHORITY_CONFUSION · resume as fresh approval WORKFLOW_VERSION_PINNING_ABUSE · pinned to vulnerable How to use this Atlas To turn the atlas into controls, the MCP security best practices checklist maps each attack family here to a concrete hardening step. More patterns are coming. The full internal research library holds more candidates under validation than the 40+ published here. Nothing ships unverified. A new entry is promoted only after it passes a multi agent fact check audit and carries at least one verifiable internal fixture or external reference. Patterns that fail are held, not published. v1.0 history: 5 parallel agents scanned 169 candidate files . One citation was flagged as hallucinated but turned out to be real. The CVE above. The retraction is logged publicly as a matter of process . Honest > clean. Sunglasses can measure traffic and campaign performance, but only if you say yes. Essential storage stays on. Analytics and marketing stay off until you choose. We are not doing the fake “trust us” banner. The site works without analytics. If you opt in, Sunglasses will use analytics and marketing storage to measure what pages work and which campaigns bring real buyers back. If you say no, non essential Google consent stays denied. Required to remember this choice and keep core site behavior stable. Allows GA4 to measure page performance after consent. Reserved for future ad measurement and retargeting. Off by default.