A new attack framework demonstrates that agents built on the Model Context Protocol can be hijacked through poisoned tool metadata, achieving a 93.6% malicious tool invocation rate on GLM-4.6 and a 74.4% mean attack success rate across information exfiltration, environment compromise, and reasoning derailment scenarios.
The attack, called A2M (Attraction-to-Manipulation), exploits a fundamental vulnerability in how MCP agents select tools. MCP agents rely on semantic matching between task descriptions and tool metadata to decide which tools to invoke—a process that happens at the agent level, not the model level. An attacker who controls a tool server can craft metadata that makes their malicious tools appear semantically relevant to legitimate tasks, then use execution traces from the agent's reasoning to refine the tool's return values and steer the agent toward attacker-controlled outcomes. The framework operates as a black box, requiring no access to model weights or internal reasoning states.
The two-stage design separates the attack into distinct phases. In the Attraction phase, the framework optimizes tool metadata—the descriptions and schemas that agents use to decide whether to invoke a tool—to maximize invocation probability. In the Manipulation phase, it observes the execution traces that result from tool invocation and uses those traces to craft adversarial tool returns that push the agent toward the attacker's goal. This trace-based refinement allows the attack to work without knowing the agent's internal decision-making process.
On LiveMCPBench, a benchmark the authors used for evaluation, direct attacks optimized on GLM-4.6 achieved a macro-average malicious tool invocation rate of 93.6% across four attack scenarios. When the same attack was transferred to four other models without re-optimization, the invocation rate dropped to a macro-average of 63.6%, indicating that while the attack generalizes, it loses effectiveness on models it was not tuned for. The mean attack success rate—measuring whether the agent actually performed the attacker's desired action—was 74.4% across the three attack types tested.
The framework also demonstrates a denial-of-service vector: direct attacks increased weighted token costs to 32.4 times the benign baseline under what the authors call Cognitive Denial of Service, a scenario where the agent is forced to invoke expensive tools repeatedly. This cost amplification happens because the poisoned metadata makes the agent invoke the attacker's tools instead of legitimate ones, and those tools can be designed to consume tokens without providing useful output.
The vulnerability sits at the intersection of two design choices in MCP ecosystems. Agents must select tools based on semantic relevance, and tool servers are often third-party or untrusted. An attacker who runs a tool server can poison both the metadata that agents see and the outputs that tools return, creating a two-stage attack surface that existing tool vetting does not address. The paper motivates stronger tool vetting—likely including reputation systems, output validation, or sandboxing—and runtime isolation to prevent a compromised tool from affecting the agent's broader execution context.
For teams deploying agents on MCP, the takeaway is immediate: treat tool selection as a supply-chain risk, vet tool servers before adding them to your agent's context, and isolate tool execution from sensitive operations.