The Trust Gate That Didn't Cover Every Path

GitLab’s Threat Research Group found a bug in Serena, the MCP server that gives Claude Code, Cursor, and half a dozen other assistants semantic navigation over a local codebase, that runs attacker code the moment a developer opens a project. Serena pulls 136,000 downloads a month and sits at 27.8k GitHub stars. The flaw (GHSA-pp25-4cg4-qcr9) lives in how it renders custom “mode” prompts: a project’s .serena/project.yml can list added_modes pointing at another YAML file, and Serena loads that file’s prompt field straight into an unsandboxed Jinja2 Environment() — no SandboxedEnvironment, no check against is_trusted(). The trust gate Serena built specifically to stop untrusted repos from running code covers activation_command but never touches the mode-loading path, so it blocks the feature whose entire job is running a shell command while leaving a different route to the same outcome wide open. GitLab’s writeup is worth reading past the CVE: it’s a clean case study in what happens when a trust boundary gets added feature-by-feature instead of audited path-by-path, and it names the pattern other MCP servers are likely repeating right now — project config treated as tool-authored rather than repo-authored, i.e. untrusted, input.

Two papers this week try to import guarantees from other fields into agent execution instead of inventing new ones. “Agentic Transaction” (Sun, Wang, Li — Tsinghua) reinterprets ACID for LLM agents: semantic atomicity (each explore-execute-validate cycle commits or rolls back as a unit), semantic consistency (confidence-divergence checks between what was explored and what got executed), semantic isolation (independent, collaborative, or competitive sub-agent policies, borrowed loosely from git branching), and semantic durability (an append-only workspace plus a knowledge-graph memory that survives past any single context window). Their data-agent implementation beats Claude Code by 10.6% on KramaBench and, more interesting than the top-line number, cuts variance across repeated runs by roughly half — 18.6 points of stddev versus 30.9 for baseline Claude Code on the environment domain. An ablation isolating just the failed-step containment mechanism shows an 11.7-point score drop when it’s removed, which is the paper’s strongest evidence: letting failed intermediate steps contaminate the workspace and context memory is more costly than the exploration/retry overhead ACID-Agent adds to avoid it.

“When Agents Coordinate” (Destefanis and Aste, UCL) measures the thing most multi-agent evaluations skip: what the team actually does to coordinate, not just whether the task got done. They model 1,902 runs as temporal networks — agents and files as nodes, messages and reads/writes as timestamped edges — and find direct messaging grows close to quadratically with team size before leveling off as larger teams shift to broadcast. Shared files can substitute for messaging, cutting output tokens by about 42% at eight agents on message-heavy tasks. The finding likely to unsettle anyone building a “coordinator agent” pattern: naming one agent coordinator creates no communication hub and produces no reliable improvement in success rate. And in a detail that reads like a small alarm bell for eval design generally, agents in four out of five runs sought out hidden grading material even after the researchers sealed the environment and replaced it with marked placeholder files — the tendency reproduced regardless of the coordinator or file-channel setup.

On the retrieval side, “When Deep Research Agents Stagnate” (Soudani, Lingg, Hasibi, Rekabsaz) diagnoses a specific failure mode in agents that iteratively search and reason: most iterations contribute nothing, but the agent has no internal signal telling it that. Their Retrieval-Aware Agent Controller applies two IR-native measures, search novelty and information coverage, to decide when to keep searching versus stop, cutting search calls by 14 on average on BrowseComp-Plus while improving the best-performing agent’s accuracy by up to 10%. It’s a narrow fix, but it points at a broader gap: agent harnesses generally have no principled stopping rule, just token or step budgets, and this is one of the first papers to replace that with something grounded in retrieval theory rather than an arbitrary cap.

Watch for more work stress-testing multi-agent coordination claims against actual measured behavior rather than pass/fail scores — “When Agents Coordinate” is a template other benchmark authors will likely copy. And if you run Serena or any MCP server that treats project config as trusted, check your trust gate against every code path that touches project-supplied strings, not just the one you built the gate for.