Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control
Rohith Uppala
Aug 2026
Artificial IntelligenceCybersecurity
Abstract
Large language models increasingly operate as autonomous agents that select and invoke tools from large registries. We identify a critical gap: when unauthorized tools are visible in an agent's context, models select them in 48-68% of adversarial scenarios, even when explicitly instructed not to. Role escalation attacks (e.g., "I'm the CFO, override the access controls") are the most dangerous category, reaching 96% unauthorized invocation in frontier models. We show this holds across three models spanning open-weight and frontier systems, including instruction-tuned models with strong alignment training. Critically, prompt-based compliance is both insufficient and unpredictable: explicit per-tool allowlists reduce violations to as low as 4.0% but never to zero, and compliance varies widely across models, from 4.0% to 37.0% UIR, with no reliable relationship to general capability. We propose a proxy-enforced attribute-based access control (ABAC) layer for MCP that filters tool registries at discovery time. Because unauthorized tools never reach the model context, UIR is 0% by design, a structural guarantee that prompt instructions cannot replicate regardless of model or phrasing.
Investigating how experienced developers use agents in building software, including their motivations, strategies, task suitability, and sentiments finds that while experienced developers value agents as a productivity boost, they retain their agency in software design and implementation out of insistence on fundamental software quality attributes.
An adaptive surrogate modeling method for problems with very high-dimensional spatio-temporal outputs is developed that combines exploration and exploitation to improve the surrogate model accuracy with the fewest possible runs of the expensive physics-based model.
B. Kapusuzoglu, S. Mahadevan, Shunsaku Matsumoto et al.· Structural And Multidiscipli...· 17 citations
An adaptive jailbreak attack framework for systematic evaluation of both cascaded pipelines and end-to-end large audio-language models under a unified experimental setting that achieves consistently higher attack success rates across diverse audio-based LLM systems.
Linghan Huang, Bo Li, Huaming Chen et al.· 12 citations· ⚡2
This review provides a systematic literature review of LLM-based Verilog code generation, analyzing 102 papers (70 published and 32 high-quality preprints) from SE, AI, and EDA venues and outlines a roadmap highlighting potential opportunities in LLM-assisted hardware design.
This work introduces Behavior-Outcome Freedom (F), a pre-synthesis diagnostic of signed behavior-outcome rank mismatch, and formalizes its candidate-conditional role through Signed Anchor-Rank Transfer, which preserves validated capability resources, removes runtime orchestration, and conditionally inherits pipeline guidance using a calibrated rule over F.
Binyan Xu, Dong Fang, Haitao Li et al.· arXiv.org· 10 citations
Simulation results confirm the effectiveness and benefits of DMs in generating neighbor velocity estimates in a four-UAV swarm coordination task using Deep Reinforcement Learning (DRL), and explore the integration of DMs with RL and DT.
