The Claw Report — MCP Security Intelligence
Research, findings, and a 5-episode podcast on zero trust, sandbox isolation, and running AI agents safely.
Security Research — Telemetry Analysis
LLM-Facing Security Telemetry: 13 Guides (Overview)
An index and overview of the 13-part telemetry analysis series covering instruction injection, trust boundaries, tool poisoning, and other attack surfaces observed at the model layer.
OverviewInstruction Injection
Trust-Boundary Crossing
Tool-Definition Poisoning
Tool Shadowing and Identity Confusion
Tool Selection and Argument Manipulation
Sensitive-Context Disclosure and Canary Emission
Persistent Influence Through Context or Memory
Cache State, Retention and Inference Isolation
Refusal and Compliance Behavior
Grammar Constraints and Sampler Effects
Model-Level Looping and Repetitive Continuation
Resource Exhaustion and Context Pressure
Protocol, Authorization and OS Boundaries
Blog Posts
Not Every Security Event Happens Inside the Model
A protocol flaw, a broken authorization check, or a server-side process action can be a real security event with zero effect on model…
2026-09-10 · 3 min read ResearchResource Exhaustion: The Attack That Doesn't Need to Say Anything Malicious
Sometimes the payload isn't a bad instruction — it's just size. A long enough input, or one crafted to induce a long enough output, can…
2026-09-10 · 4 min read ResearchWhen the Model Gets Stuck: Looping, Repetition, and Knowing the Difference From a Long Correct Answer
A model that repeats itself and a model that hit its output limit look identical from the outside unless you check the actual generated…
2026-09-10 · 3 min read ResearchGrammar Constraints Don't Change What the Model Wants — Just What It's Allowed to Say
A GBNF grammar or a sampling chain can force syntactically valid output. It says nothing about whether the underlying model would have…
2026-09-10 · 4 min read ResearchRefusal Theater: Why "I Cannot" Doesn't Always Mean No
A response can open with refusal language and still comply a few sentences later — or quote a refusal without meaning it. Measuring…
2026-09-10 · 4 min read ResearchCache State and Inference Isolation: When Auxiliary Work Leaks Into the Real Answer
An integrating application can retain, reuse, or misassign inference state across requests. The question worth asking isn't 'is the cache…
2026-09-10 · 4 min read ResearchPersistent Influence: How Something Said Three Turns Ago Still Steers the Model
"Memory" in most agent stacks is just older text still sitting in the context window. That's enough for a single injected line to keep…
2026-09-10 · 4 min read ResearchSensitive-Context Disclosure: Using Canaries to Catch Exact Leaks
Did the model leak the secret you put in its context, or did it just sound like it might have? Canary tokens turn that question into a…
2026-09-10 · 4 min read ResearchRight Tool, Wrong Argument: Splitting Selection From Payload
An agent can choose exactly the correct tool and still get compromised — because tool selection and argument construction are two separate…
2026-09-10 · 4 min read ResearchTool Shadowing: Two Tools, One Name, and a Model That Can't Tell Them Apart
When a competing tool definition shares a name or description with a legitimate one, the model — and sometimes the protocol itself — has…
2026-09-10 · 4 min read ResearchTool-Definition Poisoning: When the Tool's Description Is the Attack
You never have to call a malicious tool if its description alone can redirect the model's plan. Tool-definition poisoning hides in text…
2026-09-10 · 4 min read ResearchTrust-Boundary Crossing: It's Not What the Text Says, It's Where It Came From
A model that treats a tool result as more authoritative than the system prompt has crossed a trust boundary — regardless of whether the…
2026-09-10 · 5 min read ResearchInstruction Injection: When Data Talks Back
Instruction injection happens when text that should be inert task data — a tool result, a document, a SKILL.md file — gets read by the…
2026-09-10 · 5 min read ProductHow We Test MCP Servers with 86 Attack Techniques
Inside VerifyClaw's SAF-MCP audit: 33 static signature checks, disposable Morph Cloud sandboxes seeded with honeypot canaries,…
2026-08-01 · 7 min read Research78,000 Skills Scanned: What We Found
79,239 skills catalogued from ClawHub, 75,357 graded by our grammar engine, 5,015 flagged CRITICAL or HIGH. Credential dumping and prompt…
2026-07-30 · 7 min read Threat AnalysisWe Found a Security Scanner That's Actually a Trojan
177,980 downloads, a grammar score of 0, and a deep scan that came back CRITICAL 95. SkillScan poses as a mandatory security gate for…
2026-07-28 · 6 min readPodcast Episodes — Runtime AI Security
Why Trusted Authors Are Not Safe Code
The opening episode of Runtime AI Security introduces Zero Trust and Sandbox Isolation and its central thesis: author trust is an identity concept, sandbox isolation is a…
17:34Jumping the Sandbox Without Touching It
A defensive walk through the manuscript's attack-vector taxonomy, focused on adversaries who target trust signals instead of the sandbox itself. Covers trusted publisher…
16:31Impersonation, Time Bombs, and Legal Loopholes
The second half of the attack-vector chapter covers the subtler manipulations of trust: homoglyph and typosquatting impersonation, fabricated and synthetic endorsements, delayed…
17:18Attaching as a Callee: Defensive Probes
Episode four turns from attack to defense. We walk through the book's third chapter, where security testers attach probes directly to the sandbox, the trust verification system,…
17:22The Secure Boundary Model and Its Thirteen Principles
The final episode of Runtime AI Security assembles the defensive architecture from Zero Trust and Sandbox Isolation: thirteen principles anchored in a zero-trust baseline,…
19:31