BARBICAN Gateway Paper Splits MCP Prompt Injection Fixes

The short version

BARBICAN is a layered gateway paper that tries to block hidden orders in Model Context Protocol tool servers. Researchers break attacks into parts you can swap, repair, or remove instead of treating every alert the same.

What the researchers did

İpek Abasıkeleş Turgut and colleagues published Deletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN, a Layered Prompt-Injection Gateway for MCP on arXiv on 23 October 2026. preprint, not yet peer-reviewed

They built BARBICAN as a gateway between an agent and MCP tools. MCP is the Model Context Protocol that lets agents call external tools with structured messages. The gateway sits in the middle and inspects traffic both ways.

It labels suspicious content to parts such as instructions, tool data, or returned payloads. Labeling means marking which slice of context caused the alert. Then it applies different responses per part type.

Those responses include deletion, swap, repair, and transplant. Deletion drops a bad segment. Swap replaces it with a safe stub. Repair tries to fix format issues. Transplant moves content to a quarantine channel for review.

What they found

The paper argues that one big filter misses cases where only one segment of a long context is malicious. By labeling parts, the gateway can act with a scalpel instead of blocking whole sessions.

They evaluate against recent hidden order cases aimed at tool using agents. Tests include near target cases that look almost like real tasks. Near target means the bad text mimics real ticket or email wording.

Results in the PDF show where each action type helps. Security teams can map those actions to runbooks instead of replaying entire prompts by hand. Delay and false positive tradeoffs vary by scenario.

We could not fetch every table in this run. Open the primary PDF for full numbers before you change prod rules.

Why it matters for you

MCP adoption is rising inside firms that connect agents to tickets, code, and customer records. A gateway that explains which layer failed is easier to audit than a black box refusal.

Security teams can log part level labels, not only allow or deny. Auditors ask why a tool call stopped. Named parts answer that question faster than a generic block message.

Dev teams wiring MCP servers should test BARBICAN style ideas on staging before production. Your delay budget and false positive tolerance may differ from the paper defaults.

What to keep in mind

This is a preprint gateway design. Your delay budget and false positive tolerance may differ. Agents evolve quickly, so replay tests on your own MCP servers are still required.

Keep human approval on high risk tools even with a gateway. Payments, deletes, and mass email tools should not run on auto after a filter pass alone.

Test near target cases that mimic real ticket text from your ITSM export. Generic public datasets may not match your short forms or footer lines.

Peer review may add bypass cases. Plan quarterly red team hours as models and plugins change.

Log quarantine transplants long enough for review but not so long that GDPR retention rules break. Legal should set TTL on held prompt slices.

SRE teams should watch p99 delay when the gateway parses long tool payloads. Security wins mean little if agents time out on normal tickets.

Train support staff not to paste whole email threads into agent chat. Shorter context reduces attack surface even with a gateway.

Product managers should not treat the gateway as a checkbox on a slide. Runbooks and logs matter more than a logo on a deck.

Key takeaways

• Log part level labels, not only allow or deny.
• Test near target cases that mimic real ticket text.
• Keep human approval on high risk tools even with a gateway.
• Posted 23 October 2026 on arXiv with MCP focused test scenarios.
• Four actions deletion, swap, repair, and transplant map to runbooks.

Photo: Sora Shimazaki / Pexels

Photo: Pixabay / Pexels

Sources

• Primary — arXiv, Deletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN, a Layered Prompt-Injection Gateway for MCP (23 October 2026). Gateway design and component attribution method.