Outside the Prompt: Measuring Trust Boundaries of AI Coding Agents Outside the Model — Preregistration (v2)

Abstract

Preregistration of the confirmatory parts of the study "Outside the Prompt", which measures where security failures of AI coding agents and their connectors trigger relative to the model's decision. It fixes, before the measurements: the research questions and hypotheses (classification of June–September 2026 disclosures with independent raters; client behaviour when an approved MCP tool definition changes; observability of these events in default host telemetry), the frozen classification criteria, the inclusion rules and neutral-summary procedure for the dataset, the raters (author and three open-weight models with exact tags and digests), the analysis plan (Cohen's and Fleiss' kappa, five repetitions per lab cell), and the lab protocols for Q3 and Q4. Measurements already run before freezing (trust boundary of repository-declared MCP servers; defence coverage in official MCP servers; a ten-case classification pilot, Fleiss' kappa 0.91) are declared as exploratory. All lab work uses systems owned by the author and harmless canaries. Target journal: Transactions on Machine Learning Research (TMLR).