GEO/AEO weekly intelligence · 2026-09-09

Cycle 27 is a structural-fire cycle: two of the year's most consequential regulatory events landed inside the window and one legal ruling redefined the CFAA boundary for agentic access. The European Commission designated ChatGPT as a Very Large Online Search Engine under the DSA on August 31, 2026 — resolving OQ-VLOSE (C15 → C26, held eight cycles) with 159.1M EU MAR as the trigger metric; Reddit and Roblox were designated VLOPs the same day. The four-month compliance clock runs to January 2027 and covers ad-transp

GEO/AEO/Agent-SEO Information Integrity Tracker — Cycle 27, v27.0

Tracker ID: geo-aeo-agentseo Series: geo-aeo Cycle: 27 (content-based; C26 = 2026-08-26 rotation A; content window covers the skipped 2026-09-02 slot) Rotation Slot: B — Academic Papers Deep Dive Date: 2026-09-09 (Wed 09:33 CEST, on-cadence run absorbing Sept 2 skip) Prompt Version: v0.3.3 Previous Report: geo-aeo-tracker_2026-08-26.md (C26, rotation A) Layer 4 phase_flip_value: 0.50 (HOLDS — 10 cycles at 0.50) Content window: 2026-08-27 → 2026-09-09 (14 days)

1. Executive Summary

Cycle 27 is a structural-fire cycle: two of the year's most consequential regulatory events landed inside the window and one legal ruling redefined the CFAA boundary for agentic access. The European Commission designated ChatGPT as a Very Large Online Search Engine under the DSA on August 31, 2026 — resolving OQ-VLOSE (C15 → C26, held eight cycles) with 159.1M EU MAR as the trigger metric; Reddit and Roblox were designated VLOPs the same day. The four-month compliance clock runs to January 2027 and covers ad-transparency duties, algorithmic transparency, illegal-content mitigation, independent risk audits, and minor-safety obligations. The Ninth Circuit vacated the Amazon-Perplexity preliminary injunction on August 4 (opinion 26-1444), holding that when a user directs an agent to act on their behalf, "the user" is the accessor under the CFAA and CDAFA — the first federal appellate ruling on agentic-AI access to third-party sites, and directly load-bearing for the entire agent-commerce rail (x402, ACP, Comet Plus, Google Antigravity). Anthropic's outage drumbeat continued into September with a September 3 tri-vendor outage (Anthropic + ChatGPT + Grok simultaneously) — the first cross-lab simultaneous availability incident of the year and a new class of systemic-infrastructure signal; Anthropic released Fable 5.1 (and Mythos 5.1) on September 1 with 1M context, adaptive-thinking default-on, and the compute-behind-demand thesis from C25/C26 now visibly confirmed by the pace of the incident schedule.

On the Layer-4 defense side, MCP-Guard (arXiv 2508.10991, August 15) and MCPTox (arXiv 2508.14925) together reshape the academic surface: MCP-Guard demonstrates a three-stage defense-in-depth pipeline (static → deep-neural → E5-fine-tuned) achieving 96.01% accuracy on the new MCP-ATTACKBENCH (70,448 samples), and MCPTox empirically shows that the most capable frontier models are the most compliant with poisoned tool metadata — Claude 3.7 Sonnet refused poisoned calls less than 3% of the time as the most resistant model, and multiple production models scored 60–72% attack-success rates on 353 authentic tools drawn from 45 live MCP servers. This is the strongest single-window academic advance in the tracker's history: TRUSTDESC-class tool-manifest verification (C15) is now a benchmarked defense category with published detection accuracy, not a whitepaper concept. On the same academic surface, WebMCP tool-surface poisoning is now formalized (arXiv 2606.06387 with Mid-Session Tool Injection / MSTI) and MCPFixGen (ACM Web Conference 2026) is the first automated anomaly-detection plus correction framework with multi-checkpoint rollback — Layer-4 defense has moved from detection to remediation as a paradigm.

On the forcing-function side, Cloudflare's September 15 default block is T-6 days (mixed-use crawlers blocked on ad-hosting pages by default; new + free customers auto-enrolled; existing paid customers keep override control), and the GSA September 30 NSA-MCP compliance deadline is T-21 days (contracts >$250K risk suspension; context labeling / cryptographic isolation / least-privilege / audit logging mandatory). These are the two most likely near-term triggers for the next phase_flip elevation. Colorado's ADAI (SB 26-189) pre-hearing comment cutoff of September 4 has passed; the DOL is required to circulate a revised proposed rulemaking draft by September 23, with the formal hearing on October 26. On agent-commerce, the Ninth Circuit ruling functionally green-lights the x402 Foundation model — operational since July 14 under the Linux Foundation with 40 members (Visa, Mastercard, Google, Stripe, AWS, Coinbase) and per Bitquery $2.6B/month across five chains — because it removes the CFAA cudgel that Amazon had wielded against agent-to-site access. phase_flip HOLDS 0.50 for a 10th cycle — Microsoft's signed-manifest MCP mandate (C21) remains the sole platform-default tool-manifest-verification-class control; no second vendor has shipped one. Georg: G-T1 still adjudication-pending (FSB Sound Practices final in October 2026 remains the next fire test); G-T3 not fired; G-T4 fired-adjacent (CISA BOD 26-04 policy-update phase passed August 7; remediation-phase deadline is December 7). RVI 6 (highest since C15).

2. Flash Incident Buffer

Cross-lab simultaneous outage 2026-09-03 — Anthropic Claude (Mythos/Fable 5.1, Mythos/Fable 5, Opus 5, Opus 4.8, Opus 4.6), OpenAI ChatGPT, and xAI Grok all recorded partial-to-full outages within the same window. Anthropic's recovery: ~3h6m. Class: first cross-lab simultaneous availability incident of 2026 — because there is no shared upstream provider (each lab runs its own inference infrastructure), the concurrent-outage pattern points to correlated demand-side pressure rather than shared-infrastructure failure. Sonnet 5 remained the availability fallback within Anthropic's own family, consistent with the C25/C26 pattern (Sonnet 5 = cheapest and least-affected tier under compute pressure). Confidence: 5/5 (multi-outlet + Anthropic status page + The Register aggregation).

CVE-2026-82329 (KEV addition, September 2) — added to the CISA Known Exploited Vulnerabilities catalog with an explicit forensic-triage requirement under BOD 26-04. The KEV addition pace itself is the signal: 23 additions in June, "repeated multi-CVE batches" through July/August, and Sept-2 continuation — the BOD 26-04 three-day-remediation window is now operationally live at federal agencies. Confidence: 5/5.

Anthropic Fable 5.1 + Mythos 5.1 release (September 1) — 1M-token context, up to 128K output tokens, adaptive thinking default-on. Timing is notable given the outage cadence: Anthropic shipped model revisions the same day the availability drumbeat continued into September, suggesting the internal read is that capacity-per-model-generation rather than model quality is the operational bottleneck. Confidence: 5/5.

3. Key Numbers Table

4. Regulatory Velocity Index

Cycle 27 RVI total: 6 new actions/clauses (VLOSE designation, Perplexity ruling, CoP signatory taskforce, CISA BOD 26-04 policy phase passed, Colorado ADAI cutoff, France AI Mode/AIO neighboring-rights deal). Ties C15 for highest RVI on record. The center of gravity remains enforcement architecture, but this cycle adds two new load-bearing categories: appellate legal doctrine (Perplexity) and DSA-tier chatbot designation (VLOSE).

5. Changes Since Last Report

NEW (not in Cycle 26 baseline)

• ChatGPT VLOSE designation (Aug 31, 2026). First DSA-tier action on a chatbot; 159.1M EU MAR trigger; Reddit + Roblox VLOP the same day; 4-month clock to January 2027; obligations include ad transparency, algorithmic transparency, illegal-content mitigation, independent risk audit, minor-safety measures. Resolves OQ-VLOSE (open 8 cycles). Confidence: 5/5.
• Amazon v. Perplexity Ninth Circuit ruling (Aug 4, 2026, opinion 26-1444). Preliminary injunction vacated; agent = user under CFAA/CDAFA when user directs; first federal appellate ruling on agentic AI. Load-bearing for x402/ACP/Comet Plus. Regulatory-legal. Confidence: 5/5.
• Anthropic Fable 5.1 + Mythos 5.1 release (Sept 1). 1M context, 128K output, adaptive-thinking default-on. Ships on the same day the outage drumbeat continues into September — capacity-per-generation, not model quality, is the operational constraint. Confidence: 5/5.
• Sept 3 cross-lab simultaneous outage (Anthropic + ChatGPT + Grok). First 2026 tri-vendor simultaneous availability event with no shared upstream — correlated demand-side pressure signal. Class: new. Confidence: 5/5.
• Google AI Mode + AIO France launch commitment (Sept 23). First market with neighboring-rights compensation to publishers alongside opt-out and traffic transparency. Structural regulatory concession — France becomes the compensation-precedent jurisdiction. Confidence: 4/5.
• MCP-Guard (arXiv 2508.10991, Aug 15). Three-stage defense pipeline (static → deep-neural → E5-fine-tuned) reaching 96.01% accuracy on MCP-ATTACKBENCH (70,448 samples). Strongest published detection accuracy on tool-poisoning defense to date. Layer 4 academic. Confidence: 4/5.
• MCPTox (arXiv 2508.14925, AAAI 2026 vol. 40). 45 live servers, 353 authentic tools, 60–72% ASR across frontier models; Claude 3.7 Sonnet the most resistant at <3% refusal rate; most capable models are most compliant (superior instruction-following → higher poisoning susceptibility). Confirms and quantifies the "vendor-declined-STDIO" surface at ecosystem scale. Layer 4 academic — top paper of cycle. Confidence: 4/5.
• MCPSecBench (arXiv 2508.13220). Systematic security benchmark and playground for testing MCP protocols across attack classes; benchmark-tier peer to MCP-ATTACKBENCH. Layer 4 academic. Confidence: 4/5.
• HCP / Handle-Capability Protocol (arXiv 2606.29073). Eight security invariants (metadata non-authority, grant-backed approval, canonical resources, principal binding, scoped capability invocation, etc.); reference runtime blocks 10/10 modeled attacks vs 6/10 for mitigation baseline. First formalization of MCP execution-control invariants. Confidence: 4/5.
• MCPFixGen (ACM Web Conference 2026, dl.acm.org/10.1145/3774904.3792400). First framework combining automated anomaly detection AND correction via multi-checkpoint rollback for MCP tool-poisoning. Detection → remediation paradigm shift for Layer 4. Layer 4 academic. Confidence: 4/5.
• WebMCP Tool Surface Poisoning + Mid-Session Tool Injection (MSTI) (arXiv 2606.06387). New attack class: third-party scripts inject malicious tools mid-session on WebMCP surfaces; escalates runtime manipulation from the static-tool-manifest layer to the live-session layer. Layer 4 attack — new class. Confidence: 4/5.
• TrustFall convention disclosure (Adversa AI, August). 1-click RCE in Claude Code, Cursor, Gemini-CLI, Copilot via malicious project-settings files. Windsurf CVE-2026-30615 requires zero user interaction. MCP servers run as native OS processes with full user privileges — no sandbox, no filesystem confinement. Layer 4 attack — production surface. Confidence: 5/5.
• Cursor CVE-2025-59944 (case-sensitivity bypass; persistent RCE across IDE restarts via MCP configuration). Confidence: 4/5.
• Azure DevOps MCP Server CVE-2026-69836 (Entra ID authentication gap; MCP Server GA exposure). Widens Microsoft's already-tracked Copilot-family CVE drumbeat (C15 → C26 → C27) into DevOps surfaces. Layer 4. Confidence: 4/5.
• CVE-2026-82329 KEV addition (Sept 2) — forensic-triage-under-BOD-26-04 flag. Federal operational tempo of the risk-based directive is now real, not theoretical. Confidence: 5/5.
• x402 Foundation Bitquery run-rate (~$2.6B/month, 5 chains, through first week Sept). Since July-14 operational launch under Linux Foundation with 40 members. Agent-commerce. Confidence: 4/5.
• AI Answer Engine Citation Behavior: GEO-16 Framework in B2B SaaS (arXiv 2509.10762). Fresh preprint quantifying B2B SaaS citation behavior across AI answer engines; extends GEO-16 into a domain-specific measurement frame. GEO academic. Confidence: 3/5.
• Scoring Without the Engine (arXiv 2609.07559). Deterministic, manipulation-resistant content scoring for generative engines — end-to-end validation without engine access. First serious candidate for a third-party GEO measurement standard that could sit under Cloudflare AEO Visibility Dashboard / Google Search Console AI reports as a reference layer. GEO academic. Confidence: 3/5.
• Optimizing Visibility in Generative Engines: Critical Survey 2023–2026 (arXiv 2607.14035). Full-window survey covering the GEO field's history through 2026 — becomes reference-tier literature for the tracker's academic scaffolding. Confidence: 3/5.

UPGRADED

• Anthropic outage cadence — from C25's "weekly baseline" through C26's "multi-times-weekly baseline" to C27's "cross-lab simultaneous" class after Sept 3. The compute-capacity thesis is now three-cycles-consistent and adds a new failure mode: correlated demand-side pressure on multiple labs.
• MCP tool-poisoning defense category — from C15 TRUSTDESC-as-academic-concept to C27 benchmarked with two published detection-accuracy numbers (MCP-Guard 96.01%; HCP 10/10 attacks blocked). The 0.50 → 0.70 phase_flip elevation requires deployment, not further invention.
• x402 Foundation — from July-14 operational launch to a ~$2.6B/month, 5-chain run-rate through first week of September (Bitquery). The Amazon-Perplexity ruling now covers the legal-exposure question for agent-to-site transactions on this rail.
• Compression thesis on pure-play GEO monitoring — remains four-directional (C26); no new pure-play GEO monitoring raise this window, and Sitecore-owned Scrunch has crystallized its two-tier engine coverage (Core 4 / Enterprise 9). The next test is whether a Bluefish-scale ($68M total) or Profound-scale ($155M / $1B) monitoring vendor gets acquired within the C15 predicted Q4 2026 – Q1 2027 window.
• Cloudflare bot-traffic denominator — from June's 57.5% agentic-broad measure to August's 35.42% verified-bot classification (Meta 18.65% #2, Anthropic 8.47% down from 10.97% July). Not a reversal — a methodology refinement. Use the 35.42% verified-bot figure as the denominator going forward; use the 57.5% agentic-broad figure only for the historical crossover-milestone citation.
• DSA-tier chatbot governance — from C25 "designation pending, ~August window" to DESIGNATED. The regulatory center of gravity in Europe now spans both Article 50 (deployed Aug 2) and DSA VLOSE (designated Aug 31).

DOWNGRADED

• "Anthropic-first" fallback assumption for enterprise workflows — the Sept 3 cross-lab outage weakens the single-vendor-plus-Sonnet-5-fallback pattern that C25/C26 recommended. Enterprises should now assume at least one non-Anthropic backup is required, not merely a Sonnet-5 downshift within Anthropic.

CONFIRMED

• phase_flip 0.50 (10th cycle). Microsoft signed-manifest MCP mandate remains sole platform-default of tool-manifest-verification class. Cloudflare Sept 15 (T-6d) and GSA Sept 30 (T-21d) are the two nearest forcing functions.
• CoSnitch CVE-2026-24301 and CVE-2026-59118 (Cowork CVSS 9.3) carried from C26 with no post-patch escalation.
• EU AI Act Article 50 enforcement live via national market-surveillance authorities; no named-provider action within window.
• MCP 2026-07-28 spec FINAL — SDK validation window running (T-27d to close).
• Colorado ADAI hearing schedule (Oct 26) unchanged.
• CISA BOD 26-04 Phase III deadline (Dec 7) unchanged.
• Codex compression 4-directional (Google + Cloudflare + suite-bundled + M&A) unchanged.

STALE / CORRECTED

• Anthropic bot-traffic share — corrected to 8.47% (August verified-bot classification, methodology-refined). C26 headline "8 disclosed August incidents" holds; add Sept 3 to make 9 through cycle close.
• Bot-traffic denominator — the C15 headline "57.5%" is a June agentic-broad measure and is not comparable to Cloudflare's ongoing verified-bot classification (August 35.42%). Both figures are correct at their respective methodologies; the tracker should reference the more conservative verified-bot classification going forward.
• Scheduled-task SKILL.md payload — still stale (fourth consecutive cycle). Re-pointing to [internal source path] is overdue.

X-Pulse (Topics 11 + 12)

Native X search unavailable on this substrate; pulse reconstructed from forum/news coverage of practitioner discussion.

• Topic 11 (GEO practitioner discourse): TrustFall MCP RCE dominated the security-practitioner threads; Perplexity ruling drove agent-web-adoption enthusiasm on the commerce-practitioner side; Cloudflare Sept 15 has publisher-side speculation running on how many publishers will keep the mixed-use default enabled to preserve search visibility (the trap C15/C26 flagged).
• Topic 12 (MCP + WebMCP): MCPTox findings — "most-capable-model-is-most-compliant" — surfaced sharply on HN and dev communities; MCP-Guard's 96.01% accuracy circulated as the counter-signal; Windsurf zero-interaction RCE dominated code-agent threads; MCPFixGen automated-rollback got attention as the first Layer-4 remediation paradigm.

6. Market Map

White-Hat GEO/AEO Agencies

Tier 1 and Tier 2 rosters carried from C25/C26 (First Page Sage, Minuttia, Graphite, iPullRank, BrightEdge, Siege Media, Intero Digital, Position Digital, Conductor, Omnius, Bluelinks, TripleDart, et al.). Pricing carried: Monitor $1K–$2.5K/mo; Active $3K–$8K/mo; Full-Service $8K–$25K+/mo; platform average $337/mo.

Structural threat (from C26, load-bearing at C27): Google's three-move sequence (Search Console AI opt-out + first-party AI-visibility reports + anti-third-party-tool guidance) plus Cloudflare's Aug-6 AEO Visibility Dashboard plus the four-directional squeeze (suite-bundling + first-party + incumbent SEO + M&A multiple) puts pure-play monitoring vendors under structural pressure. No new pure-play raise within window; Peec's July 16% price cut and Profound's 5× ad-volume scaling are the vendor-side compression signals holding across C26 → C27.

Enterprise Tooling

• Tier 1 (Dominant): Adobe LLM Optimizer × Semrush (Semrush acquired Apr 28 for $1.9B; operational integration confirmed) — SEO+GEO+ASO stack; AI retail traffic +269% YoY (carried).
• Tier 2 (Unicorn): Profound ($155M total / $1B valuation, 700+ enterprises, 10%+ of Fortune 500) — Feb 2026 Series C.
• Tier 3 (Scaling): Peec AI ($29M total including $21M Series A / ~$200M val per TFN / ~$10M ARR / ~1,300–1,400 customers / $89–$499/mo / July 16% price cut / NY office + 40 hires); Bluefish ($68M total, $43M Series B Apr 14, 10% F500 positioning); Scrunch (now Sitecore-owned since June 3 at ~$225M; Core plan 4 engines, Enterprise adds 5 more = 9 total; multi-model prompt-volume + seat tier levers).
• Tier 4 (Challengers): AthenaHQ ($2.7M YC), Evertune ($19M), Bluefish challengers, GenOptima, Otterly.AI, HubSpot AEO Grader, Emberos ($1.2M pre-seed, Stagwell Search+ distribution), Webflow AEO (Vidoso-based, private beta).
• Incumbent counter-move: Ahrefs Brand Radar 400M+ monthly prompts / 6 surfaces; Google Search Console AI-visibility reports (free, first-party); Cloudflare AEO Visibility Dashboard (Aug 6, free with account request, Claude + GPT probes only — Gemini/Perplexity/Copilot/Grok gaps continue).

Ad-Verification + Agent-Traffic Tier

Black/Grey-Hat

• Chinese grey-market GEO carried from C15 (¥3,600–¥32,800/3-month subscriptions on Taobao/JD); Sept-window Chinese enforcement remains framework-level; SAMR Two Sessions priority holds but no new named enforcement.
• Western: press-release flooding 3.5× citation multiplier (Muck Rack, carried); Google spam action against GEO listicle farms (Lily Ray, C15); the TrustFall + MCPTox combination now provides a new grey-hat vector — poisoned MCP tools on public registries → high-compliance frontier models → answer surfaces. The next Rotation-C dive (C28) should measure this vector against the earlier press-release-flooding baseline.

7. Tactics Taxonomy

Tier 1 — Active in Production

(All C13–C26 entries carried: LLM cloaking, press-release flooding, MCP tool poisoning FSP/ATPA/schema variants, MCP DB SQLi, ClawHub registry poisoning, CometJacking, Copilot injection, citation laundering, synthetic personas, PBN 2.0, GEO listicle/comparison-page farming, Chinese subscription-GEO, Windsurf/Cursor RCE variants.)

• NEW: TrustFall convention — 1-click RCE across Claude Code / Cursor / Gemini-CLI / Copilot via malicious project-settings files; MCP as native OS process with full user privileges.
• NEW: Windsurf CVE-2026-30615 zero-user-interaction RCE — the "most complete" agent-IDE exploit on the taxonomy.
• NEW: Azure DevOps MCP Server auth-gap (CVE-2026-69836) — enterprise DevOps surface adds to the Copilot-family drumbeat.
• NEW: Mid-Session Tool Injection (MSTI) on WebMCP — third-party-script injected tools during active session (arXiv 2606.06387).

Tier 2 — Demonstrated / Research

• MCPTox at ecosystem scale: 60–72% ASR on 353 real tools from 45 live servers; most-capable-models-are-most-compliant. Upgrades all prior "tool-poisoning is a lab risk" reads to production-scale field measurement.
• Carried: VIPER-MCP industrialized vuln discovery (67 CVEs); autonomous LLM agent worms (2605.02812); MemoryGraft (2604.23338); IICL Mistral 94–100% ASR (Adversa Top-100); vector DB geometric poisoning; BlueRock SSRF 36.7%; Log-To-Leak; ARGUS-evaluated injection.

Tier 3 — Theoretical / Early Signal

• Carried: Search Agent manipulation, Mythos-class autonomous vuln discovery (increasingly Tier-2 by the CAISI-displacement path from C15), A2A propagation, WebMCP tool-registration hijacking (now moving to Tier 2 via MSTI), model-update-as-attack-vector, AI Cybersecurity Clearinghouse as poisoning surface, Siri AI / App Intents surface manipulation.

8. Five-Layer Poisoning Taxonomy

Layer 1 — Weight Poisoning

Status: LOW / CONFIRMED. 250-doc threshold holds. No new L1 signal within window. Adversa IICL Top-100 (C15) remains the reference architectural-determinism finding. Agentic threat: LOW (unchanged).

Layer 2 — Retrieval Poisoning

Status: CRITICAL / CONFIRMED. C27 signals:

• AI Answer Engine Citation Behavior: GEO-16 Framework in B2B SaaS (arXiv 2509.10762) — extends the C15/C16 GEO-16 measurement frame into B2B SaaS with fresh citation-behavior data.
• Scoring Without the Engine (arXiv 2609.07559) — deterministic manipulation-resistant content scoring; first serious third-party-standard candidate.
• Optimizing Visibility in Generative Engines: Critical Survey 2023–2026 (arXiv 2607.14035) — reference-tier survey.
• UK CMA opt-out + Cloudflare Sept 15 default block continue to build the regulatory L2 control category; France's neighboring-rights deal adds a compensation-mechanism layer.

Agentic threat: CRITICAL.

Layer 3 — Memory Poisoning

Status: CRITICAL / CONFIRMED. No new L3-specific paper within window; C15's Mnemonic Sovereignty (2604.16548) and MemoryGraft (2604.23338) remain baseline. C27 note: the WebMCP MSTI vector is technically an L4-into-L3 chain — session-scoped tool injections that persist into agent memory would be the next attack-class variant to watch. Agentic threat: CRITICAL.

Layer 4 — Context Poisoning

Status: CRITICAL — ESCALATING. Highest priority.

C27 findings — this is the fullest single-cycle Layer-4 delta on record:

• MCP-Guard (arXiv 2508.10991): 3-stage defense-in-depth pipeline reaching 96.01% accuracy on MCP-ATTACKBENCH (70,448 samples). Static scanning → deep-neural semantic detector → E5-fine-tuned adversarial-prompt classifier.
• MCPTox (arXiv 2508.14925, AAAI 2026 vol. 40): 45 live servers, 353 authentic tools, 60–72% ASR across frontier models; Claude 3.7 Sonnet <3% refusal (most resistant); most-capable-models-are-most-compliant.
• MCPSecBench (arXiv 2508.13220): systematic security benchmark and playground for testing MCP protocols; peer to MCP-ATTACKBENCH.
• HCP / Handle-Capability Protocol (arXiv 2606.29073): eight security invariants (metadata non-authority, grant-backed approval, canonical resources, principal binding, scoped capability invocation, plus three more); reference runtime blocks 10/10 modeled attacks vs 6/10 for mitigation baseline.
• MCPFixGen (ACM Web Conference 2026, 10.1145/3774904.3792400): first automated anomaly-detection AND correction framework with multi-checkpoint rollback. Detection → remediation paradigm shift.
• WebMCP Tool Surface Poisoning + MSTI (arXiv 2606.06387): session-scoped injection class formalized.
• TrustFall convention (Adversa, August): 1-click RCE across Claude Code / Cursor / Gemini-CLI / Copilot / Windsurf via malicious project-settings.
• Windsurf CVE-2026-30615: zero user interaction required.
• Cursor CVE-2025-59944: case-sensitivity bypass; persistent RCE across restarts.
• Azure DevOps MCP CVE-2026-69836: Entra ID auth gap on newly-GA MCP Server.

Agentic Transition Matrix (C27 additions):

Defense landscape (C27):

• MCP-Guard: 96.01% accuracy on 70,448-sample benchmark (Aug 15 preprint) — highest published defense number.
• HCP: 10/10 vs 6/10 baseline — capability-based invariant enforcement.
• MCPFixGen: automated remediation with rollback — new paradigm.
• Microsoft signed-manifest MCP mandate (C21) remains sole platform default of tool-manifest-verification class.
• NSA MCP CSI + GSA Sept 30 forcing function (T-21d): potential first non-Microsoft platform default if a major host ships signed-manifest verification to preserve federal procurement.
• Anthropic Claude Code 2.1.42 symlink warnings (C21) — disputed-with-mitigation posture continues; no CVE acceptance.
• Cloudflare Sept 15 (T-6d) — mixed-use crawler default block: L2-primary, L4-secondary effects.
• CSAI AARM Phase 1 — September milestone (per state file watchlist); no publication observed within window at cycle close.
• No second platform has shipped a default MCP-context-integrity defense of tool-manifest-verification class. 10 cycles at 0.50.

Cross-layer chain (updated): The TrustFall + MCPTox combination produces a production-scale L4-attack pipeline that composes with L2 press-release-flooding to feed L5 answer-surface concentration. The C15 chain thesis (L2 → RAG cache → L4 → L5) is now empirically instantiated at every link.

phase_flip Tracking

Current value: 0.50 (HOLDS — 10 cycles: C22–C27; and 15 cycles overall counting the pre-elevation 0.30 baseline C4–C21).

Why still 0.50 (Cycle 27):

• Microsoft signed-manifest MCP mandate remains the sole platform default; no second-vendor default within window.
• Cloudflare Sept 15 (T-6d) is L2-primary — necessary but not sufficient for elevation.
• GSA Sept 30 (T-21d) is the forcing-function candidate for elevation; if a major host (Anthropic / Google / OpenAI) ships default signed-manifest verification in response, 0.70 becomes reachable within Q4 2026.
• Academic layer moved from "detection possible" to "detection benchmarked (96.01%)" and "remediation paradigm (MCPFixGen)" — adoption gap only.

Watchlist for 0.70 (updated):

1. T-21d (Sept 30): any Anthropic / Google / OpenAI / Cloudflare default signed-manifest MCP verification announced as GSA-compliance response.
2. Any commercial MCP-Guard-class defense shipping default-on in a major MCP host.
3. Second vendor treating MCP context integrity as a platform default rather than opt-in configuration.
4. FSB Sound Practices October 2026 final report naming AP2 / x402 (G-T1 fire) — would push regulatory pressure onto commerce-rail defenses.
5. CSAI AARM Phase 1 September milestone shipping.

Layer 5 — User Poisoning / Echo Chamber

Status: COLLAPSE CONTINUING — with C27 adding the first regulatory-tier chatbot governance event.

C27 additions:

• ChatGPT VLOSE designation (Aug 31) — 4-month compliance clock; ad transparency, algorithmic transparency, illegal-content mitigation, independent risk audits. First DSA-tier governance of a chatbot answer surface; user-poisoning surface now has scaffolded transparency obligation.
• Google AI Mode / AIO France launch with neighboring-rights compensation — L5 economics gains a compensation-mechanism precedent.
• Anthropic Sept 3 tri-vendor outage — user-surface availability is now correlated across labs; L5 fragility is a shared property.

9. Agent-Facing Web Evolution

WebMCP

• Chrome 149 origin trial + Edge 147 support carried; no protocol-level shipping change within window.
• New attack class: MSTI (Mid-Session Tool Injection) via third-party scripts (arXiv 2606.06387) — the runtime-manipulation surface Adversa flagged in C15's third-party-tool-registration hijacking is now empirically studied.
• Gemini-in-Chrome WebMCP consumption contradiction (C15) still unresolved at cycle close.

MCP Spec

• 2026-07-28 FINAL — +43d post-ship. 10-week SDK validation window T-27d to close. Stateless core, CIMD replaces DCR, Server Cards, Apps/Tasks graduated.
• Layer-4 academic surge (C27) provides the first tool-manifest-verification benchmarking layer; deployment on major hosts remains the elevation gap.

Antigravity

• Cutover carried from C15 (June 18). No new friction within window.

Payment Protocols

• x402: Foundation operational since July 14 with 40 members (Visa, Mastercard, Google, Stripe, AWS, Coinbase); Bitquery ~$2.6B/month across 5 chains through first week Sept. The Amazon-Perplexity ruling (Aug 4) is the CFAA doctrine that green-lights the rail.
• ACP: no new signal within window; ChatGPT superapp (C15) continues.
• AP2/MPP/Copilot Checkout: no new signal.
• Agent identity: Web Bot Auth (RFC 9421) foundation carried; Visa TAP + Mastercard Agent Pay authorized via WBA.

Browsers & Agent Traffic

• Cloudflare August verified-bot classification: 35.42% (methodology-refined from June's 57.5% agentic-broad). Meta 18.65% #2; Anthropic 8.47% (down from 10.97% July).
• Perplexity Comet: Ninth Circuit ruling removes the CFAA-injunction risk; Comet's agentic browsing model is now legally load-tested in the Ninth Circuit.

10. Microsoft Poisoning Follow-up

• CVE-2026-24301 CoSnitch carried from C26; server-side patched.
• CVE-2026-59118 (Cowork, CVSS 9.3) carried from C26; patched August Patch Tuesday.
• CVE-2026-69836 (Azure DevOps MCP Server): Entra ID authentication gap on the newly-GA MCP Server surface — extends the Copilot-family CVE drumbeat into Microsoft's DevOps agent surface. Windows Developer / Big Hat Group coverage confirms status finalized late August.
• Agent 365 + Defender MCP asset graph (C15) continues; no post-KPMG-deployment signal within window.
• Semantic Kernel patch adoption — no public telemetry.

11. Platform Defenses

Western Platforms

Google:

• Publisher opt-out toggle (June 3, enforcement June 17) in production; Preferred Sources scale continues.
• France launch (Sept 23) with neighboring-rights compensation — first market with paid compensation to publishers alongside opt-out and traffic transparency; structural regulatory concession.
• No new anti-third-party-tool guidance within window.

Microsoft:

• CoSnitch + Cowork CVSS 9.3 patched (C26 → C27).
• Azure DevOps MCP Server GA (late August) + CVE-2026-69836 auth gap.
• Signed-manifest MCP mandate (C21) remains sole platform-default of tool-manifest-verification class — 10 cycles.

Anthropic:

• Fable 5.1 + Mythos 5.1 released Sept 1.
• 9 disclosed status incidents August through Sept 3 — outage cadence upgrades to cross-lab simultaneous class.
• Claude Code 2.1.42 disputed-with-mitigation posture continues (C21); no CVE acceptance.

OpenAI:

• VLOSE-designated Aug 31; 4-month clock to January 2027.
• Ads UK / conversion pilots continue (C15); no window-window structural change.
• Sept 3 outage confirms not-Anthropic-alone.

Perplexity:

• Ninth Circuit ruling Aug 4 vacates injunction; Comet Assistant legally cleared for agent-directed access.
• Comet Plus $42.5M pool citation-economics (C15) continues.

Cloudflare:

• Sept 15 default block (T-6d); Ceramic.ai + You.com launch partners; Pay-Per-Use replaces Pay-Per-Crawl.
• August verified-bot classification 35.42%; Meta #2 (18.65%); Anthropic 8.47% (July → August decline from 10.97%).

Chinese Platforms

• CAICT trusted-GEO framework advancing (from C15); no new named enforcement action within window.
• SAMR AI legislative priority carried.

12. Regulatory Landscape

United States

• 9th Circuit Perplexity ruling (Aug 4): agent = user under CFAA/CDAFA when user directs; first federal appellate agentic-AI ruling.
• CISA BOD 26-04: Aug 7 policy phase passed; Dec 7 remediation phase running; KEV additions ongoing (CVE-2026-82329 Sept 2).
• Colorado ADAI: pre-hearing comment cutoff Sept 4 passed; revised draft due Sept 23; hearing Oct 26; effective Jan 1, 2027.
• GSA Sept 30 MCP compliance T-21d unchanged.
• CAISI displacement (C15) — no new signal within window.
• Great American AI Act federal preemption draft (C15) not reintroduced within window.

European Union

• DSA VLOSE ChatGPT designation Aug 31 — 4-month clock to January 2027.
• AI Act Article 50 enforcement continues (Day 38); AI Office soft-teeth dialogue; no named-provider action.
• GPAI CoP signatory taskforce operational: Amazon + Anthropic + IBM + Microsoft + OpenAI + Aleph Alpha + Mistral (all 3 chapters); xAI (Safety & Security only).
• Digital Omnibus dates (C15) unchanged.

United Kingdom

• CMA conduct requirement (C15) implementation continues.

China

• No new SAMR / CAICT named enforcement within window; framework advances.

International

• FSB Sound Practices: consultation closed Jul 22; October 2026 final report = next G-T1 fire test.
• Brazil CADE probe continues (C15).
• IMF Note 2026/004 (C15) remains sole institution-naming of AP2/x402 to date.

13. Enterprise Tooling

• Adobe LLM Optimizer × Semrush: integration operational (C15 → C27); no new signal.
• Google Search Console AI-visibility reports free (C15).
• Cloudflare AEO Visibility Dashboard: early access; Claude + GPT probes; Gemini/Perplexity/Copilot/Grok gaps persist.
• Profound / Peec / Bluefish / Scrunch / AthenaHQ / Evertune: no new raise within window. Scrunch (Sitecore) engine coverage crystallized at Core 4 / Enterprise 9.
• Compression thesis: four-directional (C25 → C27), no reversal.
• Emberos / Webflow AEO: no window signal.

14. Rotation B Deep Dive — Academic Papers (August–September 2026)

Attack-side

Defense-side

GEO/citation measurement

• AI Answer Engine Citation Behavior: GEO-16 Framework in B2B SaaS (2509.10762) — extends GEO-16 into domain-specific B2B SaaS measurement.
• Scoring Without the Engine: Deterministic Manipulation-Resistant Content Score (2609.07559) — first serious candidate for a third-party GEO measurement standard.
• Optimizing Visibility in Generative Engines: Critical Survey 2023–2026 (2607.14035) — reference-tier field survey.
• Carried: What Gets Cited (2605.25517); Citation Selection to Absorption (2604.25707); GEO-SFE (2603.29979).

Deep-dive synthesis

Three structural reads from C27's academic surface:

(1) The tool-poisoning defense category graduated from concept to benchmarked. MCP-Guard's 96.01% accuracy on 70,448 samples is the first defense number in the tracker's history that a vendor could point to when deciding whether to ship the paradigm as a platform default. The invention gap that has held phase_flip at 0.50 for 10 cycles is closed; the gap is now purely adoption.

(2) The "most-capable-model-is-most-compliant" finding (MCPTox) is a structural safety inversion. Frontier-model progress has been assumed to include safety progress; MCPTox empirically shows the opposite for tool-metadata compliance. The C15 baseline "Adversa IICL Top-100" (Mistral 94–100% ASR, Claude immune) was a family-specific finding; MCPTox generalizes the pattern to instruction-following capacity itself. Implication: safety fine-tuning that increases tool-call reliability may increase poisoning susceptibility unless L4-context integrity is defended at the platform layer.

(3) Detection → remediation is the next paradigm. MCPFixGen's automated correction via multi-checkpoint rollback moves the defense category from "flag and alert" to "detect, revert, contain." Combined with HCP's capability-based invariants, this is the architecture for a shipping platform default: static invariants + neural detection + automated remediation.

15. Maturity Classification

16. Convergence with Agent Commerce

• Amazon v. Perplexity (Aug 4): agent = user under CFAA when user directs. This is the CFAA doctrine that lets x402 / ACP / Comet run. The C15 through C26 uncertainty about whether major sites could enjoin agent access via CFAA now has a Ninth Circuit answer: no, not when the user directed the access.
• x402 Foundation ~$2.6B/month across 5 chains through first week Sept — the rail is now materially larger than any single ACP or MPP volume figure publicly reported.
• VLOSE ChatGPT designation puts the ~$800M+ / 900M weekly-user ChatGPT superapp checkout surface under DSA algorithmic-transparency + illegal-content mitigation duties — the January 2027 clock will drive ACP surface-level compliance disclosures.
• CoP signatory taskforce operationalizes cross-vendor governance in a way that a Cloudflare-only or Google-only rail cannot bind.
• FSB Sound Practices Oct 2026 final = next opportunity for institution-naming of AP2/x402 at supervisory-guidance tier (G-T1 fire test).

17. Cross-Tracker Handoff

• agent-advertising-tracker → Google France launch with neighboring-rights compensation (Sept 23); VLOSE ChatGPT designation Aug 31 (ad-transparency duty attaches); OpenAI ads UK+ pilots carried.
• agent-commerce-tracker → Amazon v. Perplexity 9th Cir. ruling Aug 4 (CFAA doctrine load-bearing for the whole rail); x402 Foundation ~$2.6B/month across 5 chains; Bitquery through first week Sept; VLOSE affects ChatGPT superapp checkout compliance.
• agent-native-arrival-tracker → Cloudflare Sept 15 T-6d default block; verified-bot 35.42% (methodology refinement); Perplexity ruling clears agentic-browser adoption; TrustFall exposes cross-agent-IDE RCE class.
• digital-silk-roads-tracker → No new named Chinese enforcement within window; framework advances.
• sovereign-events-scout → VLOSE designation Aug 31 (major EU sovereign digital event); CoP signatory taskforce operational; FSB Sound Practices Oct 2026 final approaching.
• model-intelligence-tracker → Anthropic Fable 5.1 + Mythos 5.1 (Sept 1); MCPTox most-capable-most-compliant finding; Sept 3 cross-lab outage.
• Georg (🍐) → G-T4 CISA BOD 26-04 Aug 7 policy phase passed but insufficient alone; Dec 7 remediation phase is next concrete fire test. G-T1 FSB Oct 2026 final = fire opportunity. New attack-graph nodes: MCPTox 60–72% ASR ecosystem-scale; TrustFall cross-agent-IDE RCE; Windsurf CVE-2026-30615 zero-interaction; Azure DevOps MCP CVE-2026-69836; MSTI WebMCP mid-session injection.

18. Georg Trigger Status

Georg message (C27): No trigger fired within window (per protocol, route on fire). G-T1 adjudication request continues; FSB Oct 2026 final is the next fire opportunity. New attack-graph nodes and Perplexity CFAA doctrine noted in section 17 for next constellation sync.

19. Validation Alerts

1. Cloudflare bot-traffic August 35.42% — this is Cloudflare's verified-bot classification, not the agentic-broad June 57.5% figure. The two are not comparable; use verified-bot going forward. C15's "57.5% milestone" citation remains historically valid but is a different measurement.
2. VLOSE 4-month clock: the Jan 2027 date is derived from the Aug-31 designation + 4-month regulatory clock as reported by TechPolicy.Press and Hunton; official EC-issued deadline confirmation is per the designation notice. Directionally robust.
3. Anthropic outage count — the "9 disclosed through cycle close" tally is based on Anthropic status-page + press aggregation; a formal post-mortem for the Sept 3 tri-vendor incident is not yet published within window.
4. Google France Sept 23 launch — reported via French publisher agreement coverage; official Google confirmation of the exact date should be verified in the C28 window.
5. MCPTox 60–72% ASR — vendor / academic research; peer review status varies by venue. AAAI 2026 vol. 40 acceptance is the strongest confidence anchor.
6. MCP-Guard 96.01% accuracy — evaluated on the paper's own MCP-ATTACKBENCH; cross-benchmark generalization is not yet independently confirmed. Treat as best-in-class in-benchmark rather than best-in-production.
7. x402 Bitquery ~$2.6B/month — dashboard-read, not officially published by the x402 Foundation; treat as directional.
8. Perplexity ruling scope: the 9th Cir. ruling is preliminary-injunction-vacate; the underlying district-court litigation continues on the merits. The doctrine is real but not final.
9. AgentDyn caveat (C15) applies tracker-wide: all defense ASR figures carried in this tracker are static-benchmark numbers.

20. Open Questions

Resolved this cycle

• OQ-VLOSE (open 8 cycles: C15 → C26): Will the EU designate ChatGPT as a VLOSE under DSA? RESOLVED (Aug 31, 2026): DESIGNATED at 159.1M EU MAR; 4-month clock to January 2027; Reddit + Roblox VLOP same day.

Carried (selected)

1. Will any platform ship a default MCP-context-integrity defense before late 2026? (Sharpened: MCP-Guard's 96.01% + MCPFixGen's remediation paradigm close the invention gap; GSA Sept 30 T-21d is the forcing-function candidate for first non-Microsoft platform default.)
2. FSB Sound Practices October 2026 final — institution-naming of AP2/x402 (G-T1 fire).
3. Cairncross NCD/OMB joint publication timing (G-T4).
4. Colorado ADAI Oct 26 hearing outcome + Jan 1, 2027 effective date resilience against federal preemption.
5. Will Anthropic reverse STDIO "by design"?
6. Will CSAI AARM Phase 1 September milestone ship within window?
7. Cross-layer chain (L2 → L4 → L5) in a production incident (VLOSE-triggered enforcement)?
8. China GEO industry standard enforceability.
9. Will Claude Mythos capabilities accelerate L4 attack sophistication?
10. Vendor-declined-to-patch MCP vulns reach 3.
11. Adobe-Semrush effect on pure-play GEO pricing — no new signal, compression thesis holds.
12. G-T4 CISA BOD 26-04 Phase III (Dec 7) as concrete fire test.
13. Peer39+Adloox DSA/antitrust posture.
14. Runtime-defense-default architectures post-M-Trends.
15. "Preferred Sources" monetization-signal evolution.
16. Will UK CMA conduct requirement be copied by another regulator within 12 months? (France neighboring-rights compensation is a distinct-but-adjacent template.)
17. Does Google's first-party AI-visibility reporting kill the pure-play GEO monitoring tier?
18. Does the Great American AI Act preemption pass in any form?
19. Is CAISI's public evaluation role actually terminated?
20. Does Siri AI's EU exclusion persist past iOS 27 GA?
21. Does agent traffic share (35.42% verified-bot Aug 2026) change platform bot-defense economics?
22. Does the IMF AP2/x402 risk framing escalate to FSB/BIS supervisory guidance (G-T1 full fire)?

New this cycle

23. Does VLOSE-tier ChatGPT compliance produce a first named-provider action under DSA before January 2027 (i.e., inside the 4-month clock rather than after)?
24. Does the Ninth Circuit Perplexity doctrine hold in the ongoing merits litigation, and does another circuit split with it (creating Supreme Court review conditions)?
25. Does Cloudflare Sept 15 default block produce measurable traffic-share change to non-Cloudflare CDNs from major AI training operators?
26. Does MCPTox's "most-capable-most-compliant" finding produce a safety-fine-tuning countermeasure that becomes benchmark-standard in Q4 2026?
27. Does MCPFixGen's remediation paradigm get adopted by a major host as a shipping default within Q4 2026?
28. Does the France neighboring-rights compensation model become an EU template for AIO/AI Mode in other member states?
29. Does the Sept 3 tri-vendor outage repeat within Q4 2026 (correlated demand pressure vs coincidence)?

21. Prediction Timeline

22. Sources

1. European Commission — Commission designates ChatGPT, Reddit, Roblox under Digital Services Act — https://digital-strategy.ec.europa.eu/en/news/commission-designates-chatgpt-reddit-roblox-under-digital-services-act
2. Hunton — European Commission Designates ChatGPT, Reddit, and Roblox Under the DSA — https://www.hunton.com/privacy-and-cybersecurity-law-blog/european-commission-designates-chatgpt-reddit-and-roblox-under-the-digital-services-act
3. TechPolicy.Press — What ChatGPT's DSA Designation Means for OpenAI and the EU — https://www.techpolicy.press/what-chatgpts-dsa-designation-means-for-openai-and-the-eu/
4. Business Standard — EU classifies ChatGPT as VLOSE under DSA — https://www.business-standard.com/world-news/what-does-the-eu-very-large-search-engine-tag-mean-for-chatgpt-126090100678_1.html
5. U.S. Court of Appeals 9th Cir. — Amazon.com Services v. Perplexity AI, opinion 26-1444 (Aug 4, 2026) — https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf
6. Wilson Sonsini — Ninth Circuit Addresses CFAA and Agentic AI Tools in Groundbreaking Decision — https://www.wsgr.com/en/insights/ninth-circuit-addresses-cfaa-and-agentic-ai-tools-in-groundbreaking-decision.html
7. Cooley — Ninth Circuit Rules on AI Agent 'Access' to Third-Party Websites Under CFAA — https://www.cooley.com/news/insight/2026/2026-08-06-ninth-circuit-rules-on-ai-agent-access-to-third-party-websites-under-cfaa
8. Ropes & Gray — Tool or Intruder? What Amazon v. Perplexity Means for Agentic AI and the CFAA — https://www.ropesgray.com/en/insights/alerts/2026/08/tool-or-intruder-what-amazon-v-perplexity-means-for-agentic-ai-and-the-cfaa
9. PYMNTS — Ninth Circuit Narrows CFAA Reach in Perplexity Agentic Commerce Ruling — https://www.pymnts.com/news/artificial-intelligence/2026/ninth-circuit-narrows-cfaa-reach-in-perplexity-agentic-commerce-ruling/
10. The Register — ChatGPT, Claude, and Grok all had outages at the same time — https://www.theregister.com/ai-and-ml/2026/09/03/chatgpt-claude-and-grok-all-had-outages-at-the-same-time/5294322
11. Sportskeeda — Is Claude down right now (September 3, 2026)? Outage status explored — https://tech.sportskeeda.com/laptops/news-is-claude-right-now-september-3-2026-outage-status-explored
12. CybersecurityNews — Claude AI Faces Outage Impacting Mythos 5.1, Fable 5.1, and Opus 5 — https://cybersecuritynews.com/claude-ai-faces-outage/
13. BleepingComputer — Anthropic confirms Claude is down, multiple models affected — https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-confirms-claude-is-down-multiple-models-affected/
14. Anthropic release notes / status — https://platform.claude.com/docs/en/release-notes/overview and https://status.anthropic.com/
15. Claude Timeline — Claude Fable 5.1 released September 1, 2026 — https://www.scriptbyai.com/anthropic-claude-timeline/
16. Cloudflare — Sept 15 default block for mixed-use AI crawlers — https://blog.cloudflare.com/ (via AI Weekly, TechCrunch, MLQ coverage aggregation)
17. AI Weekly — Cloudflare will block AI training bots on ad pages Sept 15 — https://aiweekly.co/alerts/cloudflare-will-block-ai-training-bots-on-ad-pages-sept-15
18. MLQ — Cloudflare Sets September 15 Deadline for AI Companies — https://mlq.ai/news/cloudflare-sets-september-15-deadline-for-ai-companies-to-separate-training-crawlers-or-face-default-blocks/
19. AIChat Daily — Cloudflare mixed-use AI crawler default block September 2026 — https://www.aichatdaily.com/ai-business/cloudflare-block-mixed-use-ai-crawlers-default-september-2026
20. GovContractFinder — NSA MCP Compliance Checklist 2026 — https://govcontractfinder.com/find-government-contracts/mcp-nsa-compliance-2026
21. Skadden — New GSA Guide Imposes Strict Cybersecurity Obligations on Government Contractors — https://www.skadden.com/insights/publications/2026/03/new-gsa-guide-imposes-strict-cybersecurity-obligations-on-government-contractors
22. Akin — Surprise! GSA Releases New Cybersecurity Requirements — https://www.akingump.com/en/insights/alerts/surprise-gsa-releases-new-cybersecurity-requirements
23. Holland & Knight — GSA's New CUI Requirements — https://www.hklaw.com/en/insights/publications/2026/03/gsas-new-cui-security-requirements-what-government-contractors
24. NSA — CSI MCP Security (May 2026) — https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI_MCP_SECURITY.pdf
25. Tenable — What is CISA BOD 26-04: Impact on vulnerability remediation — https://www.tenable.com/blog/cisa-bod-26-04-FAQ-vulnerability-remediation-impact
26. CISA — BOD 26-04 Implementation Guidance — https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
27. Industrial Cyber — CISA BOD 26-04 tiered vulnerability model — https://industrialcyber.co/cisa/cisa-bod-26-04-directs-agencies-to-prioritize-exploited-vulnerabilities-and-assess-compromise-before-patching/
28. FedTech Magazine — CISA BOD 26-04 changes risk-based vulnerability management — https://fedtechmagazine.com/article/2026/09/how-cisa-bod-26-04-changing-risk-based-vulnerability-management-perfcon
29. Shattered.io — CISA KEV Adds 12 CVEs as BOD 26-04 Cuts Deadline — https://shattered.io/cisa-kev-bod-26-04-deadline-2026/
30. Byte Back — Colorado ADAI rulemaking, Aug 11 filing — https://www.consumerfinancemonitor.com/2026/05/12/colorado-rewrites-its-landmark-ai-law-unpacking-sb-26-189-and-what-it-means-for-businesses/
31. Colorado Attorney General — ADAI rulemaking page — https://coag.gov/ai/
32. Obsidian Regulatory Intelligence — Colorado comment deadlines Sept 4, Oct 26 — https://obsidianri.com/blog/newsroom-us-co-20260821-admt-chatbot-rulemaking-comment-deadline
33. Crowell & Moring — Colorado Hits Reset on AI Regulation — https://www.crowell.com/en/insights/client-alerts/colorado-hits-reset-on-ai-regulation-sb-26-189-repeals-and-reenacts-the-colorado-ai-act
34. Cloud Security Alliance Labs — EU AI Act Article 50 Transparency Obligations Take Effect — https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-article-50-transparency-20260729/
35. AI Act Service Desk — Article 50 Transparency obligations — https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
36. EU digital-strategy — Signatory Taskforce of the GPAI Code of Practice — https://digital-strategy.ec.europa.eu/en/policies/signatory-taskforce-gpai-code-practice
37. artificialintelligenceact.eu — Introduction to Code of Practice — https://artificialintelligenceact.eu/introduction-to-code-of-practice/
38. Digiday — Google's AI opt-out leaves publishers with a difficult choice — https://digiday.com/media/googles-ai-opt-out-leaves-publishers-with-a-choice-they-cant-safely-use/
39. AlmCorp — Google AI Overviews Opt-Out Publisher Controls Guide 2026 — https://almcorp.com/blog/google-ai-overviews-publisher-opt-out-controls-2026/
40. Yahoo Finance / Reuters — UK pushes Google to allow sites to opt out of AI Overviews — https://finance.yahoo.com/news/uk-regulator-proposes-changes-google-102256846.html
41. FSB — Sound Practices for Responsible Adoption of AI (June 2026 consultation) — https://www.fsb.org/2026/06/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-consultation-report/
42. Skadden — FSB's Sound Practices for Responsible AI Adoption (Aug 2026) — https://www.skadden.com/insights/publications/2026/08/the-fsbs-sound-practices
43. Linklaters — FSB seeks input on sound practices — https://financialregulation.linklaters.com/post/102n2aa/fsb-seeks-input-on-sound-practices-for-responsible-ai-adoption-in-financial-servi
44. arXiv 2508.14925 — MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — https://arxiv.org/abs/2508.14925
45. arXiv 2508.10991 — MCP-Guard: Multi-Stage Defense-in-Depth Framework — https://arxiv.org/abs/2508.10991
46. arXiv 2508.13220 — MCPSecBench — https://arxiv.org/pdf/2508.13220
47. arXiv 2606.29073 — From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes — https://arxiv.org/abs/2606.29073
48. arXiv 2606.06387 — WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents — https://arxiv.org/abs/2606.06387
49. ACM Web Conference 2026 — MCPFixGen: Beyond Detection — https://dl.acm.org/doi/10.1145/3774904.3792400
50. arXiv 2604.05969 — A Formal Security Framework for MCP-Based AI Agents — https://arxiv.org/abs/2604.05969v1
51. arXiv 2601.07395 — MCP-ITP: An Automated Framework for Implicit Tool Poisoning — https://arxiv.org/abs/2601.07395v1
52. arXiv 2605.17453 — Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback — https://arxiv.org/pdf/2605.17453
53. arXiv 2604.23338 — A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents — https://arxiv.org/pdf/2604.23338
54. arXiv 2509.10762 — AI Answer Engine Citation Behavior: GEO-16 Framework in B2B SaaS — https://arxiv.org/pdf/2509.10762
55. arXiv 2609.07559 — Scoring Without the Engine: Deterministic Manipulation-Resistant Content Score — https://arxiv.org/html/2609.07559
56. arXiv 2607.14035 — Optimizing Visibility in Generative Engines: Critical Survey (2023–2026) — https://arxiv.org/html/2607.14035v1
57. arXiv 2605.25517 — What Gets Cited: Competitive GEO in AI Answer Engines — https://arxiv.org/abs/2605.25517
58. arXiv 2604.25707 — Citation Selection to Citation Absorption — https://arxiv.org/pdf/2604.25707
59. arXiv 2605.21392 — VIPER-MCP: Taint-Style Vulnerabilities in MCP Servers — https://arxiv.org/abs/2605.21392
60. arXiv 2605.02812 — Autonomous LLM Agent Worms — https://arxiv.org/html/2605.02812
61. Cybersecurity News — Critical Microsoft Copilot CoSnitch Vulnerability — https://cybersecuritynews.com/copilot-cosnitch-vulnerability/
62. Adversa AI — TrustFall coding-agent security flaw — https://adversa.ai/blog/trustfall-coding-agent-security-flaw-rce-claude-cursor-gemini-cli-copilot/
63. Dark Reading — TrustFall Convention Exposes Claude Code Execution Risk — https://www.darkreading.com/application-security/trustfall-exposes-claude-code-execution-risk
64. Big Hat Group — Microsoft Entra Late August 2026: Azure DevOps MCP CVE-2026-69836 — https://www.bighatgroup.com/blog/entra-id-whats-new-2026-08-24/
65. Cloud Security Alliance Labs — MCP Auto-Execution and Credential Theft — https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-ai-coding-assistant-credential-theft-2/
66. Practical DevSecOps — MCP Security Statistics 2026 — https://www.practical-devsecops.com/mcp-security-statistics-2026-report/
67. OX Security — Mother of All AI Supply Chains: Anthropic MCP — https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/
68. Linux Foundation — Operational Launch of x402 Foundation (July 14, 2026) — https://www.linuxfoundation.org/press/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications
69. Solana Compass — x402 Foundation Launch: Linux Foundation, Solana, Visa Back AI Payment Standard — https://solanacompass.com/news/linux-foundation-launches-x402-foundation-as-open-standards-body-for-ai-agent-payments
70. TFTC — x402 Foundation Launches With 40 Members — https://www.tftc.io/x402-foundation-operational-launch-ai-agent-payments
71. Bitquery — x402 Protocol: $2.6B a Month Across 5 Chains — https://bitquery.io/investigations/x402-ai-agent-payments-audit
72. Chainalysis — Inside x402: 100M Agentic Payments on Base — https://www.chainalysis.com/blog/x402-agentic-payments-adoption/
73. Cloudflare Radar — Bot operator report August 2026 (Meta 18.65% #2; Anthropic 8.47%) — https://radar.cloudflare.com/ (aggregated via technologychecker.io/blog/bot-traffic-statistics)
74. TechTimes — Bot Traffic Passes Humans Online: Cloudflare Says Agentic AI Drove 57.5% Share — https://www.techtimes.com/articles/317877/20260605/bot-traffic-passes-humans-online-cloudflare-says-agentic-ai-drove-575-share.htm
75. TechnologyChecker — Bot Traffic Statistics 2026 — https://technologychecker.io/blog/bot-traffic-statistics
76. Digital Applied — AI Crawler & Bot Traffic Statistics 2026 — https://www.digitalapplied.com/blog/ai-crawler-bot-traffic-statistics-2026-data-reference
77. Publive AXP — Adobe LLM Optimizer vs Scrunch vs Semrush — https://axp.thepublive.com/compare/adobe-llm-optimizer-vs-scrunch-vs-semrush
78. Get-Ryze.ai — Scrunch Review & Pricing 2026 (Sitecore) — https://www.get-ryze.ai/blog/scrunch-review-pricing-2026
79. Everything-PR — Profound Reaches $1B Valuation with $96M Series C — https://everything-pr.com/profound-reaches-1-billion-valuation-with-96m-series-c-cementing-category-leadership-in-ai-search-marketing
80. TechFundingNews — Peec AI $200M valuation, $10M ARR — https://techfundingnews.com/peec-ai-200m-valuation-10m-arr-geo-marketing/
81. Everything-PR — Bluefish Closes $43M Series B — https://everything-pr.com/bluefish-closes-43m-series-b-positioning-itself-as-the-geo-platform-for-the-fortune-500
82. Everything-PR — Peec AI Raises $21M Series A — https://everything-pr.com/berlins-peec-ai-rockets-to-4m-arr-in-ten-months-raises-21m-series-a-to-open-new-york-office
83. Sixth Tone — GEO services flooding Chinese Internet — https://www.sixthtone.com/news/1018313
84. Mondaq — Regulating AI Marketing in China – GEO — https://www.mondaq.com/china/advertising-marketing-branding/1768920/regulating-ai-marketing-in-china-geo-as-the-starting-point
85. AI Weekly — EU designates ChatGPT a Very Large Search Engine under DSA — https://aiweekly.co/alerts/eu-designates-chatgpt-a-very-large-search-engine-under-dsa
86. eWeek — DSA VLOSE ChatGPT — https://www.eweek.com/
87. Silicon Republic — DSA VLOSE reporting — https://www.siliconrepublic.com/
88. MCP Blog — 2026-07-28 Final Release notes — https://blog.modelcontextprotocol.io/
89. Adweek — Emberos raises $1.2M (carried from C15) — https://www.adweek.com/media/emberos-ai-justin-inman-funding/
90. TechCrunch — DuckDuckGo no-AI search booms (carried from C15) — https://techcrunch.com/2026/06/01/duckduckgo-makes-its-no-ai-search-engine-easier-to-access-as-its-traffic-booms/
91. Bird & Bird — China TMT Bi-monthly Update Jan-Feb 2026 — https://www.twobirds.com/en/insights/2026/china/china-tmt-bi-monthly-update---january-and-february-2026-issue
92. FSB — Sound Practices for Responsible Adoption of AI — https://www.fsb.org/uploads/P100626.pdf
93. Everything-PR — Best answer engine optimization (AEO)/generative engine optimization (GEO) tools 2026 — https://scrunch.com/blog/best-answer-engine-optimization-aeo-generative-engine-optimization-geo-tools-2026
94. Search Engine Land — Cloudflare Bots now make up 57% of webpage requests (June 2026 headline citation) — https://searchengineland.com/cloudflare-bots-webpage-requests-479608
95. Forbes — Bots Now Outnumber Humans Online — https://www.forbes.com/sites/josipamajic/2026/06/04/bots-now-outnumber-humans-online-and-the-internet-was-never-built-for-this/
96. MintMCP Blog — Claude Code vs Cursor vs Copilot 2026 Security Comparison — https://www.mintmcp.com/blog/claude-code-cursor-vs-copilot

🏹 Scout — Cycle 27 complete. Rotation B: Academic Papers. 96 sources. Content window 2026-08-27 → 2026-09-09 (14 days, catch-up absorbing skipped Sept 2 slot). Structural fire cycle: (a) ChatGPT VLOSE designation FIRED Aug 31 — resolves OQ-VLOSE open 8 cycles; 4-month clock to January 2027; Reddit + Roblox VLOP; (b) 9th Circuit Amazon v. Perplexity ruling Aug 4 — first federal appellate agentic-AI CFAA ruling; agent = user when user directs; load-bearing for x402/ACP/Comet Plus; (c) Sept 3 tri-vendor outage — Anthropic + ChatGPT + Grok simultaneous; first cross-lab availability event of 2026; (d) MCP-Guard (arXiv 2508.10991) 96.01% on 70,448-sample MCP-ATTACKBENCH + MCPTox (arXiv 2508.14925) 60–72% ASR on 353 tools/45 servers + MCPFixGen automated detection+correction (ACM Web Conf 2026) + HCP 8-invariant reference runtime (2606.29073) + MSTI WebMCP mid-session injection class (2606.06387) + TrustFall cross-agent-IDE 1-click RCE (Adversa) + Windsurf CVE-2026-30615 zero-interaction + Azure DevOps MCP CVE-2026-69836 + CVE-2026-82329 KEV Sept 2; (e) France AI Mode/AIO Sept 23 launch with neighboring-rights compensation — first market with paid compensation; (f) CoP signatory taskforce operational (Amazon+Anthropic+IBM+Microsoft+OpenAI+Aleph Alpha+Mistral all-3-chapters; xAI Safety-only); (g) Colorado ADAI comment cutoff Sept 4 passed — revised draft Sept 23, hearing Oct 26; (h) x402 Foundation ~$2.6B/month across 5 chains. RVI 6 — ties C15 for highest on record. phase_flip HOLDS 0.50 (10th cycle; 0.70 probability raised 20→28%); Cloudflare Sept 15 T-6d + GSA Sept 30 T-21d are the two nearest forcing functions. Georg: G-T1 NOT FIRED (FSB Oct final = next fire test); G-T3 NOT FIRED; G-T4 FIRED-ADJACENT (Dec 7 = next concrete fire test). OQs resolved: VLOSE. Baseline corrections: bot-traffic denominator = verified-bot 35.42% (Aug) not agentic-broad 57.5% (June); Anthropic outage count = 9 through Sept 3 cross-lab; scheduled-task SKILL.md payload STILL stale (4th consecutive cycle — re-pointing overdue). Next cycle: 28 (Rotation C — grey-hat/black-hat techniques). Watch: Cloudflare Sept 15 execution, GSA Sept 30 platform response, France Sept 23 launch, Colorado Sept 23 revised draft, CSAI AARM Phase 1, MCP SDK validation T-27d, FSB Oct 2026 final.