What's this about?
The statistic that frames this survey: across the Model Context Protocol ecosystem, the share of deployed tools that *modify external state* has risen from 27% to 65% of tool use. Agents have shifted from reading the world to acting on it. The paper surveys the resulting attack surface across MCP, skills and tool calling, in the Web3 context specifically.
What exactly changes between reading and writing?
A tool that only reads has a bounded worst case: it might leak information or return something wrong. A tool that writes can move money, delete records, or send messages as you. When 65% of tool calls change state, most of what an agent does is now irreversible, and every input it processes becomes a potential path to an unwanted action. Web3 sharpens this because blockchain transactions are final by design — there is no support line, no chargeback, and no undo. The safety margin that lets ordinary software recover from mistakes doesn't exist.
Why is this worth noticing?
- The 27%-to-65% figure is the useful contribution: a measured shift, not a prediction, and it dates the moment agent security stopped being theoretical.
- It joins this week's cluster on the same theme — CompoSkill's chained skills, state-semantic injection in embodied agents, the Copilot workflow compromise. All are about the same gap: capability grew faster than the enforcement around it.
- The Web3 setting is the extreme case, which makes it a useful preview of what irreversibility does to agent design generally.