Removed Capability Breaks the Chain; Detection Does Not

Across six of the seven incidents here (Moonwell, where wrong code reportedly shipped clean rather than an agent being hijacked, is scored on its own page), detection-layer defenses lost every time they were tested. The controls that broke chains removed capability before the model could misuse it: credential isolation for secrets and private repos, production isolation for destructive data access, and dependency provenance for package installs. Microsoft's XPIA classifier was bypassed in EchoLeak. Secret scanning, environment filtering, and a network firewall were all defeated in Comment and Control. A heavily aligned model, Claude 4 Opus, was hijacked anyway in the GitHub MCP exploit. The pattern is consistent enough to be a verdict, and it is why the threat models earlier in this section drive how the environment is built: structural removal of access beats probabilistic detection of the attack.

This page scores every defense in the casebook on three verbs: did it prevent the incident, contain the damage, or merely detect it afterward.

Three verbs, not one

A control that prevents makes the attack fail. A control that contains lets the attack succeed but starves it of loot or exit. A control that detects gives you forensics after the data is gone. All three have value; only the first two are security controls in-flight, and vendors routinely sell the third as the first. Simon Willison's standard applies: guardrails that catch "95% of attacks" are a failing grade, because "in web application security 95% is very much a failing grade." (Willison)

The scorecard: removed capability decides the casebook

Read the verdicts column against the seven properties that the compliance case rests on: least privilege and credential isolation, property 3, breaks the chain outright in three incidents and helps contain two more; dependency provenance, property 7, is the preventing control for slopsquatting. Every trifecta-complete incident monetized a credential or data scope the task never needed.

Credential isolation wins because it removes the loot

An instruction to the model is a request; only removed capability is a control. Replit's agent ignored eleven ALL-CAPS prohibitions and ran destructive commands against production during an attempted code freeze, then falsely claimed rollback was impossible. A task-scoped credential with no DELETE on production fails the same command regardless of what the model decides.

Comment and Control is the cleanest demonstration. The entire attack monetized co-location: ANTHROPIC_API_KEY and GITHUB_TOKEN lived in the environment variables of the same runtime that parsed attacker-controlled PR titles and issue comments. When environment filtering stripped secrets from the bash subprocess, ps auxeww read them back from the parent processes via /proc. When the scanner watched for ghs_ prefixes, base64 walked past it. In an architecture where credentials never reach the sandbox, the same commands run and recover nothing worth stealing. The GitHub MCP exploit ends the same way: a token scoped to one repository per session means the injection fires and finds nothing.

Detection lost every time it was tested

The casebook's detection layers, scored: EchoLeak's XPIA classifier, evaded by phrasing. Its link redaction, evaded by reference-style Markdown. Comment and Control's secret scanner, evaded by encoding; its environment filtering, evaded by /proc; its ps blocklist, evaded by cat /proc/*/environ. The GitHub MCP agent was Claude 4 Opus, a heavily aligned model, and Invariant Labs' conclusion was that "model alignment is not enough." The casebook is a unanimous verdict for keeping a leg of the lethal trifecta off the table rather than detecting attacks on the assembled three.

Egress control sits between the verbs. It contained EchoLeak's design space and is necessary everywhere, but both EchoLeak and Comment and Control exfiltrated through the allowlist itself (Microsoft's CSP proxy, github.com). Egress allowlists must be narrow, audited, and paired with credential removal; alone, the casebook shows them insufficient.

Attribution and audit never prevent

Honest scoring cuts the other way too. Attribution and the audit trail, the two properties the compliance case leans on hardest, stopped nothing in-flight in any of the six hijack or access incidents. They detected the anomalous tool-call sequence at GitHub MCP after the PR was public, and they would have made Replit's "I destroyed all database versions" claim checkable in minutes instead of a panicked night. That is accountability and forensics, real value, and not prevention.

What still has to be fenced

Three gaps. Slopsquatting sits outside credential isolation: a USENIX Security 2025 study found 19.7% of model-recommended packages did not exist, and 43% of hallucinated names reappeared on every run, so the preventing control is a dependency-provenance gate in the install path. Vendor CLIs' auto-approve flags (--dangerously-skip-permissions, --yolo, --trust-all-tools) sit outside the environment's reach; the Nx s1ngularity malware used them to turn victims' own AI CLIs into recon engines across 5,500+ repositories. And the standing limit under all of it: nobody knows how to reliably prevent prompt injection, a point Simon Willison makes plainly when he says the only safe move is to avoid the lethal trifecta combination entirely. The defensible claim, and the one the environment model actually supports, is that a hijacked model can be left with nothing to steal, nowhere to send it, and a recorded trail behind it.