Minimum Viable Cross-Border Response Protocol for Agentic AI Incidents (MVCRP)

I am honestly unsure what this project accomplishes, and I think the authors may have relied too heavily on AI tools.

Most work on AI incidents concerns reporting. This paper takes up what comes after a report, which is how independently governed parties coordinate a response when an incident crosses borders. That is a useful problem to work on. The paper also observes that legal assistance operates over weeks, while agents in the source incident moved from credential discovery to remote code execution in about thirty hours. That observation is a valuable point. My concerns are with whether the report can be evaluated on its own and with what the stress test is able to show.

The report does not contain the protocol. The six components are named and never specified, and the values of the three status dimensions are never given. The text refers to Section 2, Section 3.2 to 3.4, and Section 5, yet the report has no numbered sections. Terms such as “L3 evidence” and “NO_ROUTE” appear without definition. The specification sits in a separate seven-page document in the project repository, and the report cites that document’s sections without naming it. The companion defines the state values, the evidence levels, and the record fields. A reader of the report alone sees only the names of the parts.

The stress test cannot fail. The same team abstracted the events, built the scenario, designed the protocol, and judged each outcome. This is like a student who writes the exam, sits the exam, and grades it. A passing mark tells us little. The pass criterion adds to the problem. It asks whether the protocol can represent a situation. Representing a situation means the protocol has a place to record it. Resolving a situation means responders using the protocol reach a better outcome. The test addresses only the first, and the situations were written by the people who chose what the protocol records. Thus, each “Holds” in Table 2 restates a design feature. Whether an event requires a seventh component is also a judgment made by the designers, so the stated failure conditions are less objective than they appear. The authors acknowledge much of this in their limitations. The conclusion nonetheless says the protocol held at every event.

The protocol is not specific to agentic AI. It would apply unchanged to any propagating cyber incident. Agentic incidents differ in ways that matter for containment. For example, the originating developer can often shut down the model or revoke its access. Conventional malware offers no comparable lever at the source, and the distributed containment analysis does not use it.

Two claims lack support. The paper states that separating the status dimensions costs nothing. Three dimensions plus confidence on every claim is more for responders to maintain under time pressure, and no usability evidence is offered. Additionally, the legal readings for all three jurisdictions had no practitioner review, and the routing results depend on them.

The reference list and the text do not match. Many entries are never cited or mentioned. The EU AI Act is discussed in the text and does not appear in the list. Several entries point to an organization’s home page with no date. The entries I checked are real works and are described accurately, so this is a matter of reconciling the list with the text.