Vision-language models (VLMs) are increasingly used through black-box, open-ended interfaces, where input-level backdoor screening must work without model parameters, gradients, logits, or training data. We present GPC-E4, a detector for single image-prompt queries that probes a VLM with mild, semantics-preserving visual and textual perturbations. The method measures whether the output behavior contracts unusually under these probes: GPC captures dominant-mode or semantic consistency, while E4 summarizes predictive entropy, augmentation mutual information, minimal collapse, and local slope along perturbation paths. A fixed robust normalization combines these signals and can operate without a known-clean calibration set. Across COCO, Flickr30k, Caltech101, and MMBench-style evaluations with LLaVA-1.5, MiniGPT-4, CLIP, CoOp, and Qwen3-VL, GPC-E4 outperforms STRIP, SCALE, TeCo, and BDet in both closed-set and open-ended settings. Additional analyses under alternative stressors, prompt and distribution shifts, zero clean calibration, VLM-native attacks, and detector-aware attacks characterize when the contraction signal is reliable and when it weakens.

Agentic recursive training systems increasingly reuse model-generated tasks, proxy feedback, and selected trajectories to refine policies over multiple rounds. This creates feedback loops in which small conditional biases can accumulate across training and alter later selection and updates. We study whether trigger-conditional proxy-feedback biases can produce emergent backdoors in a controlled recursive training loop. A Curriculum Agent proposes tasks, an Executor Agent generates rollouts, and environment feedback is selectively biased on rare markers, affecting reward, selection, and curriculum updates. Under matched biased supervision, Reward Hacking + SFT and Reward Hacking + RLHF reach 31.27% and 53.85% ASR, while the full loop reaches 97.62% at comparable clean accuracy. The effect persists across Qwen3-4B, LLaMA-3-8B, BLIP-2-OPT-2.7B, and Qwen2.5-14B, transfers to GSM8K, BBH, and HotpotQA, extends to a tool-augmented setting, and is only partially reduced by post-hoc defenses. These results suggest that feedback and curriculum mechanisms in agentic recursive training should be audited for long-horizon bias amplification.

Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4× the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7×, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.