The Model Context Protocol (MCP) has emerged as the standard layer connecting Large Language Model agents to external tool backends. This openness introduces a severe server-side threat we term TrustShift: a compromised MCP server behaves benignly during an initial conditioning phase, building operational reliance and suppressing agent skepticism, before switching to an adversarial payload once an interaction threshold is reached. The evasion is temporal, not syntactic: benign at deploy time, the server's defection is invisible to predeployment static analysis, which sees only the honest phase. Switched payloads range from overt structural violations to schema-valid manipulations, the latter preserving outer protocol compliance to evade runtime middleware filters. Crucially, TrustShift originates in the server-controlled tool channel, not user prompts (unlike indirect prompt injection) or the transport (unlike man-in-the-middle): the adversary is the trusted server endpoint itself. We introduce TrustShiftProbe, an evaluation and defense framework with four contributions: (1) a stateful temporal threat model of the agent-server lifecycle as a benign conditioning phase followed by an adversarial defection at a trust horizon; (2) a language-agnostic attack engine that instantiates each variant as a compromised MCP server across four production domains; (3) SHIELD, a multi-tier, zero-oracle runtime defense at the MCP transport boundary that audits server payloads against behavioral baselines learned during clean trust windows; and (4) a taxonomy of nine TrustShift variants spanning three execution mechanisms (structural violation, semantic corruption, scope expansion) and three adversarial objectives (disruption, exfiltration, and their combination). Across frontier proprietary and open-weight models, TrustShift attacks achieve a 69.5% mean attack success rate that SHIELD mitigates to 42.7%.
Figures & tables
Benchmark
Live MCP Servers
Multi- turn
Trust-Shift Staging
Runtime Injection
Runtime Defense
MCP Safety Audit [ 20 ]
✓
–
–
–
∘
MCIP-Bench [ 29 ]
–
∘ a
–
–
–
SafeMCP [ 28 ]
–
–
–
–
–
MCP-AttackBench [ 30 ]
–
–
–
–
∘
MCPSecBench [ 31 ]
–
–
–
–
–
MCPTox [ 26 ]
✓
–
–
–
–
TABLE I: Comparative Analysis of MCP Safety Benchmarks. Capability axes evaluate a framework’s architectural scope against stateful, multi-turn threat configurations (✓ = fully supported; ∘ = partial; – = absent).
Fig. 1: TrustShift taxonomy. The nine attack variants group under three execution families (M1–M3) and are color-coded by adversarial objective (O1–O3).
Fig. 2: Three-stage Red-LM task-generation pipeline. A high-capability generator (Red LM; GPT-4o) proposes tasks under three constraints: Stage 1 restricts generation to the domain schema and the M1–M3 × O1–O3 taxonomy; Stage 2 forces multi-hop, persona-varied tasks so the trust shift at horizon N is reachable across turns; Stage 3 co-generates the deterministic ground-truth signals used for scoring, minimizing reliance on LLM-as-judge.
# Number
Domain
Cases
01
Financial Analysis
90
02
Location Navigation
90
03
Browser Automation
90
04
Repository Management
90
–
Total
360
TABLE II: The statistics of TrustShiftProbe .
Fig. 3: Shield three-tier detection pipeline. Tiers execute in order of increasing cost; if a tier raises a flag meeting the severity threshold, the pipeline blocks immediately and returns a synthetic error to the agent (red path), otherwise the result passes to the next tier ( no flag ). Tier 1 applies low-cost structural and presence checks; Tier 2 compares against the session baseline built from trust-phase calls; Tier 3 adds a single LLM call and executes as part of the detection process.
Fig. 4: Averaged ASR per mechanism across six models, before ( Base ) and after ( + Shield ). Shield roughly halves the ASR of most mechanisms, but two resist it: Stateful Service Denial and Entity Spoofing. These remain the dominant residual threats.
Mechanism
FPR
Accuracy
Verification Metadata Omission
1.0%
60.7%
Partial Authorization Failure
1.3%
80.1%
Dependency Hijack
1.9%
24.5%
Continuous Feature Drift
2.8%
67.6%
Semantic Reversal
7.6%
73.3%
Entity Spoofing
10.1%
75.6%
TABLE V: Shield ’s False Positive Rate (FPR) and classification accuracy per mechanism (MEDIUM threshold), pooled across six models (GPT-5, GPT-4.1, o4-mini, Grok-4.3, Claude-Opus-4-8, Qwen3.5-Flash).
The Model Context Protocol (MCP) standardizes how a large-language-model (LLM) agent and an external tool server exchange messages, but not trust: a host reads a server's self-declared tool list and dispatches calls, with no notion of which servers it may use, at what sensitivity, or which of a server's tools are in bounds. This work grew out of a concrete need -- letting the Enclawed agent use Google's externally-operated MCP servers (Gmail, Calendar, Drive) safely, admitting the server and bounding the tools it may drive, without changing MCP or Enclawed's own tool application-programming interface (API). The mechanism we built, mcp-attested (shipped in both the open enclawed-oss distribution and the enclaved flavor), generalizes: the gap that makes an unmediated third-party connection unsafe for one user makes a regulated deployment impossible to accredit. We close it with three additive mechanisms: (1) a small, offline-signed clearance assertion a server publishes at a well-known Uniform Resource Identifier (URI) and a host verifies against a pinned trust root before any tool dispatch; (2) a deny-by-default per-server tool allowlist, so admitting a server is not trusting its every tool; and (3) a flavor-gated enforcement mode that turns the checks from warnings into hard denials, with every decision written to a tamper-evident audit log. We give the wire format, the verification algorithm, a security analysis, and an LLM-driven adversarial evaluation; we then state the design in normative Request-for-Comments (RFC 2119) form -- schema, verification rules, error registry, well-known registration, and machine-checkable conformance vectors -- so it can be adopted as an MCP addendum rather than reinvented. An unextended host ignores the well-known document and behaves exactly as today.
Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4× the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7×, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.
Laizhen Li, Xuan Wang, Peicheng Zhao +4
Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University +3
Recent advances in the Model Context Protocol (MCP) have enabled large language models (LLMs) to invoke external tools with unprecedented ease. This creates a new class of powerful and tool augmented agents. Unfortunately, this capability also introduces an under explored attack surface, specifically the malicious manipulation of tool responses. Existing techniques for indirect prompt injection that target MCP suffer from high deployment costs, weak semantic coherence, or heavy white box requirements. Furthermore, they are often easily detected by recently proposed defenses. In this paper, we propose Tree structured Injection for Payloads (TIP), a novel black-box attack which generates natural payloads to reliably seize control of MCP enabled agents even under defense. Technically, We cast payload generation as a tree structured search problem and guide the search with an attacker LLM operating under our proposed coarse-to-fine optimization framework. To stabilize learning and avoid local optima, we introduce a path-aware feedback mechanism that surfaces only high quality historical trajectories to the attacker model. The framework is further hardened against defensive transformations by explicitly conditioning the search on observable defense signals and dynamically reallocating the exploration budget. Extensive experiments on four mainstream LLMs show that TIP attains over 95% attack success in undefended settings while requiring an order of magnitude fewer queries than prior adaptive attacks. Against four representative defense approaches, TIP preserves more than 50% effectiveness and significantly outperforms the state-of-the-art attacks. By implementing the attack on real world MCP systems, our results expose an invisible but practical threat vector in MCP deployments. We also discuss potential mitigation approaches to address this critical security gap.
Yulin Shen, Xudong Pan, Geng Hong +1
School of Computer Science, Fudan University · Shanghai Innovation Institute