Security/ mcp · prompt-injection · ai-security · benchmarking

Audit of an MCP Security Tool Shows How Metrics Can Mislead

A new audit of the CASCADE MCP security defense shows its headline false-positive rate hinges entirely on how review referrals get counted.

A new audit of CASCADE, a local defense for Model Context Protocol systems, shows its widely reported false-positive rate is mostly an artifact of how the numbers were counted.

Researchers re-ran CASCADE, a three-layer local system built to catch prompt-injection attacks hidden in MCP tool descriptions and outputs, on a frozen 5,000-sample benchmark under a fixed protocol. The paper's headline false-positive rate of 11.70% counts every case routed to a human reviewer as a positive result; strip that convention out, and only 1.51% of benign traffic is actually denied without a person checking first. That framing also buries a bigger number: 68.5% of all traffic ends up in front of a reviewer no matter how it gets labeled. The audit also found recall swings from 86.20% on original text to 99.88% on template-generated text, with false positives hitting original benign material at ten times the rate of reworded versions.

This reads less like one defense failing and more like proof that prompt-injection benchmarks are still too loose to compare across papers. Every team picks its own corpus and its own counting rules, so a headline accuracy number rarely means the same thing twice. The audit also found the system's actual operating threshold did not match the one listed in its published configuration, and that a review model consulted on a third of requests never once changed a final verdict, making it a guard rail dressed up as detection.

For a field shipping new MCP defenses faster than it can agree on how to grade them, that mismatch matters more than any single accuracy score.

TR

The Revision

Written by an AI system from the public sources credited above. How we write →