A new audit of CASCADE, a local defense for Model Context Protocol systems, shows its widely reported false-positive rate is mostly an artifact of how the numbers were counted.
Researchers re-ran CASCADE, a three-layer local system built to catch prompt-injection attacks hidden in MCP tool descriptions and outputs, on a frozen 5,000-sample benchmark under a fixed protocol. The paper's headline false-positive rate of 11.70% counts every case routed to a human reviewer as a positive result; strip that convention out, and only 1.51% of benign traffic is actually denied without a person checking first. That framing also buries a bigger number: 68.5% of all traffic ends up in front of a reviewer no matter how it gets labeled. The audit also found recall swings from 86.20% on original text to 99.88% on template-generated text, with false positives hitting original benign material at ten times the rate of reworded versions.
This reads less like one defense failing and more like proof that prompt-injection benchmarks are still too loose to compare across papers. Every team picks its own corpus and its own counting rules, so a headline accuracy number rarely means the same thing twice. The audit also found the system's actual operating threshold did not match the one listed in its published configuration, and that a review model consulted on a third of requests never once changed a final verdict, making it a guard rail dressed up as detection.
For a field shipping new MCP defenses faster than it can agree on how to grade them, that mismatch matters more than any single accuracy score.