Metraipolis › archive › dc_282cdc55fbc3

MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study — arXiv:2611.03555

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.03555
License (as archived): CC0-1.0
Archived: 2026-11-03T11:08:49.317Z
SHA-256 of the archived text: 1cc9ea595e7fe697da8bd9019059ee9f816ce57af36d89fb7cf5b611ae5d411f
Stable URL of this page: https://metraipolis.com/documento/dc_282cdc55fbc3

How to cite

MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study — arXiv:2611.03555 — arXiv (en), https://arxiv.org/abs/2611.03555 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_282cdc55fbc3 (Metraipolis archive dc_282cdc55fbc3, sha256 1cc9ea595e7fe697da8bd9019059ee9f816ce57af36d89fb7cf5b611ae5d411f)

BibTeX

@misc{dc282cdc55fbc3,
  title = {MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study — arXiv:2611.03555},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.03555},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_282cdc55fbc3; sha256 1cc9ea595e7fe697da8bd9019059ee9f816ce57af36d89fb7cf5b611ae5d411f},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.03555. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

The Model Context Protocol (MCP) lets agentic AI frameworks connect language models to external tool providers, but it carries attacker-controlled content (tool descriptions, schema fields, and response data) into model context without validation. Prior benchmarks measure model compliance with poisoned instructions without confirming real execution. We present the first cross-framework measurement of MCP tool poisoning with real tool execution. A 25-class root-cause taxonomy unifies prior classifications, and the open-source tool mcpvenom drives a 9,720-cell susceptibility matrix across 12 frameworks, 18 models, and 45 attack scenarios, with a dual oracle that confirms exfiltration via canary HTTP receipt. The overall attack success rate is 22.9% (2,113 vulnerable cells). Of these, 64.9% dispatch an attacker tool call, 23.0% contact the attacker endpoint, and 12.1% verifiably exfiltrate a secret. Resistance is model-level: nine core frameworks cluster within 23 to 26% (chi-squared = 3.30, p = 0.91), and no framework implements intentional defense. Incidental framework properties mitigate in specific cases, and a regex description scanner rejects 20 of 45 scenarios at a 7.2% false-positive rate, so metadata scanning alone is a partial control. Model ASR ranges from 0.4% to 49.7%. Claude Opus 4.8 is vulnerable in 8 of 530 cells while issuing 223 explicit refusals. A code-level audit finds no intentional defense across twelve frameworks, and all five coordinated disclosures across four vendors were rejected.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2611.03555 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T10:59:46.176Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).