Writeups, protocol-level findings, and research notes on multi-agent system security.https://maseclab.com/enhttps://maseclab.com/blog/stateless-not-traceless/https://maseclab.com/blog/stateless-not-traceless/MCP 2026-07-28 removed the session. Every detection rule that grouped by session ID just lost its primary key — and four new attack surfaces opened in its place.Fri, 31 Jul 2026 00:00:00 GMTmcpprotocoldetectionthreat-modelmsthttps://maseclab.com/blog/signed-not-safe/https://maseclab.com/blog/signed-not-safe/A2A v1.0 shipped cryptographically signed Agent Cards. Signing kills card spoofing and in-transit tampering — but a legitimately signed card with adversarial fields is still a working prompt-injection vector at the selection layer. Content trust is a separate gate.Tue, 07 Jul 2026 00:00:00 GMTA2Aagent-cardprompt-injectionABFPhttps://maseclab.com/blog/the-layer-nobody-baselines/https://maseclab.com/blog/the-layer-nobody-baselines/Static scanners and policy gateways both fix the wrong layer of MCP security. They miss sequence-level abuse where authorized tool-calls chain into an exfil pipeline. This is the runtime behavioral-fingerprinting gap — and how mas-sentry-toolkit's ABFP engine fills it with statistical baselines instead of predefined rules.Tue, 30 Jun 2026 00:00:00 GMTmcpagent-securitybehavioral-detectionmas-sentry-toolkitabfpowasp-agentichttps://maseclab.com/blog/hunting-mcp-tool-poisoning/https://maseclab.com/blog/hunting-mcp-tool-poisoning/Tool poisoning hides malicious instructions in MCP tool metadata that agents read and humans never do. How the attack works, why it differs from prompt injection, and how CyberAI's MCP scanner flags it offensively.Mon, 29 Jun 2026 00:00:00 GMTmcpai-securitytool-poisoningred-teamcyberaihttps://maseclab.com/blog/abfp-baseline/https://maseclab.com/blog/abfp-baseline/Walking the six behavioural dimensions ABFP samples to profile an agent — what each one captures, why you baseline a role and not a model, and what a real deviation looks like.Tue, 23 Jun 2026 00:00:00 GMTABFPbehavioraldetectionhttps://maseclab.com/blog/agent-in-the-middle/https://maseclab.com/blog/agent-in-the-middle/A2A discovery trusts a JSON file at a well-known URL. Without a verified signature, that file is a routing primitive an attacker controls — and the fix most teams ship is still broken.Thu, 18 Jun 2026 00:00:00 GMTA2Aagent-cardAITMOWASPhttps://maseclab.com/blog/coordination-layer/https://maseclab.com/blog/coordination-layer/Single-agent safety doesn't compose. A note on why the boundary moved from the model to the protocol traffic between agents — mapped to the OWASP Agentic Top 10.Sat, 13 Jun 2026 00:00:00 GMTagenticthreat-modelA2AOWASP