Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation

Rana Muhammad Ahmed, Sabahat Abbas

Security evaluations of tool-using agents often equate stored labels with behavioral facts. We audit a preserved campaign by tracing 10,200 execution rows to 180 model-bound reques…