What happened
Research (arXiv 2610.31974) demonstrates that provenance defenses which label only the text channel are defeated by a benign-looking carrier that hides an instruction in image steganography, decoded by a tool into the agent's trusted flow. The undefended pipeline leaked on 100% of attacks, keyword/regex scanners on 62.5% each, while the proposed decode-time provenance binding reduced attack success to 0% (and matches an in-process taint baseline within one trust domain but survives a compromised relay).
Why it matters
This is a concrete bypass of the provenance-based defenses currently being rolled out for agentic MCP systems: cross-modal, carrier-independent, and wording-independent. It shows that text-channel trust labeling is insufficient and that the MCP execution layer must bind trust at the decode/concealment-reversal boundary to prevent an injected instruction from reaching a sensitive action.
Attack vector
An instruction is hidden via image steganography (LSB, DCT, or metadata) in a benign-looking image (e.g. an email-signature logo) that passes text scanners that only see pixels; when a tool decodes it at runtime, the instruction is laundered into the agent's trusted control flow, bypassing provenance defenses that only track text provenance.
Affected systems
LLM agents using MCP tool orchestration with text-channel provenance/taint defenses (indirect prompt injection surface).
Mitigation
Adopt decode-time provenance binding: mint an HMAC-signed 'Untrusted' label at the concealment-reversing tool boundary and have the MCP layer independently maintain the provenance lineage (ledger + per-context taint) so a verifier blocks any call whose lineage is untrusted, even if a compromised agent presents a valid label for an unrelated trusted value.