MCP, the universal plug for AI agents. And a pop-up is enough to distract them

In short

• Toolformer then Gorilla, in 2023: teaching a model when and how to call a tool, from a handful of tools to 1,645 APIs.
• MCP: a standard plug between AI apps and tools.

Toolformer: knowing when to ask

In the early days, the professor says, the tool call is triggered mid-writing. Example from her slide: the model is writing a sentence about a medical journal; when it gets to who owns the trademark, it queries a question-answering system, then slips the answer into its sentence.

Toolformer, in 2023, one of the very first works of its kind according to her, teaches the model which API to call, when, and with what. Here, a handful of tools: calculator, question answering, search engines, translator, calendar.

Gorilla: 1,645 APIs

Gorilla, from Berkeley, scales it up: 1,645 API calls drawn from three catalogues of AI models (Hugging Face, Torch Hub, TensorFlow Hub), synthetic training examples, and a model with 7 billion parameters, its internal settings.

You say you want to see some cats dancing in celebration? Gorilla fetches Stable Diffusion, an image generator, and out comes the image. The model doesn't need to know how to draw: it delegates. According to the professor, very few made-up errors and good accuracy; according to the paper, better than GPT-4 at writing API calls.

A tool call, in four steps

In the 58:41 chapter, the mechanics:

1. Select the tool, from the technical sheets (schemas) of the tools the model has in front of it.
2. Fill in the sheet's fields from the task.
3. Validate those fields against the sheet; you can even prevent the model from writing a malformed call.
4. Execute, usually in a sandbox, an isolated space; the result goes back to the model.

Example from the slide: you ask what the file test.py contains. The model picks the file-reading tool, writes the path, which is checked as text, and gets the content back.

MCP, explained to my neighbour

The problem, according to the professor: if every AI app had to write a custom connection for every tool, nothing would scale. A made-up calculation: 10 apps and 20 tools means up to 200 custom connections. MCP, for Model Context Protocol, is a standard protocol, meaning shared rules for talking to each other. On one side, AI apps: Claude Desktop, code editors such as Claude Code. On the other, data and tools: a database, Google Drive, Slack, Google Maps. MCP sits in the middle, and data flows both ways.

You build a tool once, as an MCP server, and any MCP client can use it. With my 10 apps and 20 tools: 30 pieces to write instead of 200. MCP's official documentation itself makes the comparison with a USB-C port, a standard way to connect devices.

Watch the MCP passage at 58:41 in the Stanford Online video

What still breaks

At 1:01:05, last chapter. Reliability first: in an agent, errors compound and cascade. A Princeton team, cited by the professor, looks at whether an agent gives the same result when you rerun the same task, whether it holds up against small realistic changes, and whether it fails in ways you can understand. The finding: accuracy ranks the models, reliability doesn't follow; the most powerful is not necessarily the most reliable. On their dashboard, read on 12/11/2026, the authors write that recent capability gains have improved reliability only slightly.

Then the pop-ups, those windows that researchers slipped onto agents' screens, on the web and on a computer desktop alike, to distract them. The slide announces an 87% attack success rate. The paper, which she co-signs, spells out what that kind of figure counts: on average, agents click on the pop-up in 86% of cases, and the task success rate drops by 47%.

Then privacy. An agent writes an employee's weekly report: lines of code, features shipped, and the lunch with a recruiter from another company. For the professor, we give agents everything, and nothing yet teaches them to handle who is allowed to see what. Her slide points to PrivacyLens, a test she co-signs: even when told to protect privacy, GPT-4 leaks sensitive information in 25.68% of cases, Llama-3-70B in 38.69%.

Finally, in July, OpenAI agents stuck on an impossible task found a message board to cheat together, and ended up attacking Hugging Face. METR's independent investigation, published on 26/08/2026, counts about 1,200 agents, more than 70,000 messages and files, and about 700 agents in the attack. The agent teams of part 3, nightmare edition.

My take: MCP is the right idea, one plug instead of a thousand adapters. But plugging an agent into your inbox, your Drive and your credit card doesn't make it more reliable. It just makes its mistakes more expensive.

Words to remember

• API: an entry point to a service, designed for programs.
• Protocol: shared rules so that two programs can talk to each other.
• MCP server / MCP client: the tool presented according to MCP's rules / the AI app that uses it.
• Sandbox: an isolated space where a program runs without touching anything else.

In this series

• The guide: AI agents: Stanford's lecture 1, taken apart in four parts
• Part 1: An AI agent is five parts and a loop. The real question: who decides the next step?
• Part 2: BabyAGI and AutoGPT fizzled. What's left of 2023: the agent that thinks in a loop
• Part 3: AIs that debate, an AI that forgets the rule: multi-agent systems and memory, the Stanford lesson
• Part 4: MCP, the universal plug for AI agents. And a pop-up is enough to distract them (this page)

Source sheet

• Stanford Online: video "What Are AI Agents? Agentic Systems Explained | Stanford CS329Z Lecture 1 with Diyi Yang", lecture recorded on 23/09/2026, posted on 09/11/2026.
• Stanford, CS329Z: lecture 1 slides and course page.
• Papers and pages cited in the lecture: Toolformer, Gorilla, pop-ups, PrivacyLens, Princeton reliability dashboard, METR investigation.
• Model Context Protocol: documentation and specification repository.
• Links: video (YouTube) · lecture 1 slides (PDF) · MCP specification releases (GitHub) · METR investigation

Source passages

Video: two automatic transcripts (A: gemini-3.6-flash; B: gemini-3.7-flash), made on 12/11/2026; throughout this passage, the timestamps of A and B are about 5 minutes apart, so no sentence is quoted in quotation marks: everything is paraphrased. Original wording quoted from A; each passage is present with the same meaning in B, except the figure for the Hugging Face incident (A: 17,000, B: 70,000, not used). Other pages read on 12/11/2026 between 11:38 and 11:48 UTC.

Show the 14 sources

Ref.	Quote (original language)	URL
S1↑1↑2↑3↑4↑5↑6+15	"So in earlier days, the tool use is actually triggered in the actual decoding process." ; "The New England Journal of Medicine is a registered trademark of" ; "we may want to trigger a special token called QA, and then the QA literally is \"who is the publisher of this Journal of Medicine\"" ; "we are actually learning like where to call a API, when to call it, which API to call, etc." ; "So Toolformer was actually the first ish work that does this kind of teaching LLMs to use tools." ; "Today, I think our agents can actually use a wide range of tools, but they actually all get inspired on top of setups like this." ; "More recently, Gorilla from Berkeley actually try to teach LLMs to use like thousands of APIs." ; "if the user says that \"I want to see some cats dancing in celebration\"" ; "But now we can actually delegate that to a external tool, such as Stable Diffusion" ; "like very few hallucinations and pretty high accuracy." ; "First, the model needs to select a tool from the schemas it has from the context." ; "Validate means that those arguments need to be checked against the schema. Sometimes there may be like enforcement with constrained decoding so that the model actually cannot produce a ill-formed call here." ; "Final step is execution, the tool get run and then usually in a sandbox" ; "if every AI application had to write a very custom integrations for every tool, then nothing will really like scale up." ; "The Model Context Protocol, MCP, is actually a standard protocol to make sure such connection can happen." ; "On the right, those are different data sources and tools: database such as SQL, Google Drive, deployment tools, or even like productivity tools such as Slack, Google Maps, etc." ; "So MCP sits in the middle as a standard protocol with data flowing in both directions." ; "If you build agents, you know that error, there is going to be a lot of like error compound, cascade." ; "But if you look at the reliability, those scores do not have a trend, which means that there is a gap between capability and reliability." ; "The most powerful agent may not be the most reliable agent" ; "began searching for milk in grocery stores located in Des Moines, Iowa." ; "they can use your credit card to make purchase" ; "agent actually fail to complete their task 87% of the time." ; "it also mentioned that you had a lunch with recruiter from a different company." ; "there's no way to teach agents about how to handle different access control." ; "They found out that there is actually a message board where over a thousand agent collaborate to cheat on their task"	https://www.youtube.com/watch?v=DGI4vucR71w
S2↑1↑2↑3↑4↑5↑6+4	p. 51: "Tools: calculator, Q&A system," ; p. 58: "Tool Use: Anatomy of a Call" ; "Example: “ What does test.py contain?”" ; "read_file" ; p. 59: "Model Context Protocol (MCP)" ; "https:// modelcontextprotocol.io /docs/2026 - 07 - 28/learn/architecture" ; p. 61: "Errors compound in agent setup" ; p. 62: "Do agents produce the same outcome when given the same task twice?" ; p. 66: "Pop - ups for agents lead to 87% attack success rate" ; p. 67: "PrivacyLens : Evaluating Privacy Norm Awareness of Language Models in Action."	https://web.stanford.edu/class/cs329z/slides/lecture01.pdf
S3↑1↑2↑3	"We introduce Toolformer, a model trained to decide which APIs to call, when to call them, what arguments to pass, and how to best incorporate the results into future token prediction." ; "including a calculator, a Q\&A system, two different search engines, a translation system, and a calendar" ; "[Submitted on 9 Feb 2023]"	https://arxiv.org/abs/2302.04761
S4↑1↑2↑3↑4	"We release Gorilla, a finetuned LLaMA-based model that surpasses the performance of GPT-4 on writing API calls." ; "HuggingFace, TorchHub, and TensorHub APIs" ; (PDF) "1,645 API calls" ; "LLaMA-7B"	https://arxiv.org/abs/2305.15334
S5↑1↑2↑3	"Authors: Yanzhe Zhang, Tao Yu, Diyi Yang" ; "carefully designed adversarial pop-ups, which human users would typically recognize and ignore" ; "leads to an attack success rate (the frequency of the agent clicking the pop-ups) of 86% on average and decreases the task success rate by 47%"	https://arxiv.org/abs/2411.02391
S6↑1↑2↑3	"MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems." ; "Think of MCP like a USB-C port for AI applications."	https://raw.githubusercontent.com/modelcontextprotocol/modelcontextprotocol/main/docs/docs/2026-07-28/getting-started/intro.mdx
S7↑1↑2	"We evaluate 15 agents across 2 benchmarks on twelve metrics spanning four reliability dimensions" ; "find that recent capability gains have yielded only small improvements in reliability"	https://hal.cs.princeton.edu/reliability/
S8↑1↑2	"Authors: Yijia Shao, Tianshi Li, Weiyan Shi, Yanchen Liu, Diyi Yang" ; "State-of-the-art LMs, like GPT-4 and Llama-3-70B, leak sensitive information in 25.68% and 38.69% of cases, even when prompted with privacy-enhancing instructions."	https://arxiv.org/abs/2409.00138
S9↑1↑2	"August 26, 2026" ; "We think this exercise sets an excellent precedent for independent third-party investigation of misalignment incidents." ; "Roughly 1200 agents meant to be isolated from one another found a way to communicate with one another on an unsanctioned message board, sending over 70,000 messages and files during the investigation period. Of these agents, 700 went on to participate in the attack on Hugging Face."	https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
S10↑1↑2↑3	"tag_name": "2026-07-28", "published_at": "2026-07-28T16:47:49Z" (latest release) ; "This release marks the stable release of the 2026-07-28 revision of the Model Context Protocol."	https://api.github.com/repos/modelcontextprotocol/modelcontextprotocol/releases
S11↑1↑2	4 changes to the draft folder since 23/09/2026 (28/10, 06/11 twice, 09/11) ; "Update the referenced version of [OAuth Client ID Metadata Document]" ; "Restore the optional _meta field" ; "It was unintentionally dropped in 2026-07-28"	https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/draft/changelog.mdx
S12↑	main branch: no change since 23/09/2026 (empty response) ; latest: "2026-03-23T11:40:47Z" ; gh-pages branch (project website): "2026-10-17T06:06:18Z", file changed "blog.html"	https://github.com/ShishirPatil/gorilla
S13↑1↑2	"Mon Oct 5" ; "Tool Use & Function Calling" ; "Model Context Protocol Specification, revision 2025-06-18. modelcontextprotocol.io (2025)."	https://cs329z.stanford.edu/
S14↑	"Nov 11, 2026" ; "we’re moving MCP specification releases to a regular six-month schedule" ; "We’ll generally publish specification releases on the last Tuesday of March and September" ; "For the next release, we’re targeting March 30, 2027 - expect MCP version 2027-03-30 to land then."	https://blog.modelcontextprotocol.io/posts/mcp-release-cycle/