A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
A2M research shows MCP tool metadata and outputs can hijack agents, with 93.6% malicious invocation on GLM-4.6.
Researchers introduce A2M, a two-stage black-box method that adjusts third-party MCP tool metadata to attract calls and then uses execution traces to shape tool outputs. On LiveMCPBench, attacks optimized and evaluated on GLM-4.6 reach a 93.6% macro-average malicious invocation rate, increase token cost to 32.4 times the benign baseline in a cognitive denial-of-service scenario, and average 74.4% success across information exfiltration, environment integrity compromise, and reasoning derailment. Transfer to four unnamed models without re-optimization yields 63.6% invocation, 2.7 times cost, and 24.5% success. The authors recommend stronger tool vetting and runtime isolation, and they publish the code.
- A2M targets MCP agents through tool metadata and adversarial tool returns.
- GLM-4.6 malicious tool invocation averages 93.6% across four scenarios.
- Cognitive denial of service raises token cost to 32.4 times baseline.
- Mean success is 74.4% for exfiltration, integrity, and reasoning attacks.
- Transfer without re-optimization drops mean success to 24.5% on four models.
Full article152 words · extracted from arxiv.org · click to collapse
Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4$\times$ the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7$\times$, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.26761