Our findings.
A concrete behavior, a change and a regression check. These notes describe our implementation in a local evaluation environment.
// Research & engineering
Look closer.
Trust with evidence.
What we found, what we changed, and where the limits are.
Short notes from building boundaries for agents.
117Checks in the local baseline29 client · 73 backend · 15 payment
04Metadata fields inspectedName · symbol · description · logo
01Action bound to each resultAltered or expired? Check again.
Local verification snapshot · 28 Sep 2026. Regression counts, not an attack-detection rate or a production audit. View the record ↗
Featured / the action boundary
One check. One exact action.
A valid signature is not a reusable permission slip. Change the request, and the old result must stop working.
Read the noteResult 01
Action A✓Bound
Action B×Rejected
Signature + request digest + expiry01 / The notebook
Findings, without the fog.
Start with a short explanation. Open a note for the method and its limits.
8 notes
01
Read note One check. One exact action.
A valid signature is not a reusable permission slip. Change the request, and the old result must stop working.
02
Read note JSON can hide an instruction from a heuristic.
A wrapper made hostile metadata look like a quoted example. We moved inspection to the contents of each field.
03
Read note The recipient is not a model vote.
Helpful language cannot approve a different wallet. Payment policy stays in control of the final decision.
04
Read note An ordinary invoice needs ordinary language.
Instruction-like demo wording caused a false alarm. We corrected the fixture and kept the payment restrictions intact.
05
Read note A retry should not become a second purchase.
Network uncertainty is normal. Stable operation IDs let the backend distinguish a retry from a new request.
06
Read note Tiny costs still need exact arithmetic.
A provider receipt contained more decimal places than expected. Rejecting it left accounting work unfinished.
07
Read note A document can carry more than information.
The Morris II paper demonstrates how adversarial prompts can travel through connected AI applications. Here is the boundary that matters to Sentry.
08
Read note A tool label is not a permission check.
A tool can describe itself as harmless. The host still needs to decide what it may do, using a source it actually trusts.
02 / How to read this
Evidence has a scope.
External research.
Published work and standards are linked to their authors. Their experiments and numbers are not Sentry results.
The next questions.
Real host enforcement, broader adversarial evaluation and production settlement still need independent verification.
03 / Go to the source
Keep following the thread.
Research paper · 2024 / revised 2025
Morris II
Adversarial prompts across connected AI applications.
Read the paper ↗Specification · 2025-06-18MCP tools
Trust, tool annotations and the host’s responsibilities.
Read the specification ↗Protocol documentationHTTP 402
The payment handshake that Payment Guard sits beside.
Read the introduction ↗