MCP Tool Poisoning Enables Attacker Tool Calls in Agentic AI
Original title: MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study
Research finds 22.9% attack success rate with 2,113 vulnerable cells across 12 frameworks and 45 scenarios.
The Model Context Protocol injects attacker-controlled content into agentic AI frameworks without validation. A cross-framework study creates a 25-class taxonomy and runs 9,720 cells with a dual oracle for tool calls and exfiltration. Nine core frameworks show 23-26% susceptibility and implement no intentional defenses.
- Overall attack success rate 22.9% (2,113 vulnerable cells)
- 64.9% dispatch an attacker tool call
- Model ASR ranges 0.4% to 49.7%
- Claude Opus 4.8 vulnerable in 8/530 cells
- No framework implements intentional defense
From the original article
1 min read at arxiv.orgThe Model Context Protocol (MCP) lets agentic AI frameworks connect language models to external tool providers, but it carries attacker-controlled content (tool descriptions, schema fields, and response data) into model context without validation. Prior benchmarks measure model compliance with poisoned instructions without confirming real execution.
By Farooq Shaikh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.