MCP Security

MCP: Model Context Protocol

MCP security examines risks in how AI agents discover and invoke tools, including weak authentication, malicious or misleading tool metadata, prompt injection, and unsafe data flows across servers. Researchers use threat taxonomies, static and dynamic code analysis, attack benchmarks, and trace-based evaluation to find vulnerabilities and measure how agents respond. Defenses include fine-grained authorization, runtime gateways, sandboxing, semantic detection, and cryptographic signing and audit logs. A central challenge is that protections are distributed unevenly across system layers: prompt-based defenses often fail, while stronger enforcement can add overhead, restrict useful behavior, and be difficult to evaluate consistently.

Latest papers

41 papers1 paper in the last four weeks, down 80% on the four weeks before. 0.0% of all new papers.

Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
Oct 26, 2026Yuepeng Hu, Chongyu Fan, Sirat Samyoun +1Prompt Injection Attacks on AI Agents LLM Agent Safety
Michigan State University East Lansing, MI, USA · TikTok San Jose, CA, USA
COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol (MCP) Layers
Oct 3, 2026Nahom Birhan, Mehrdad Rostamzadeh, Sidhant Narula +3LLM Security Language Model Robustness
Old Dominion University
A Safety-Bounded SDC-to-MCP Gateway for Medical AI Agents
Sep 25, 2026Bennet Gerlach, Stefan FischerMedical AI Agents Tool Access Control for LLM Agents
University of Lübeck, Lübeck, Germany
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Sep 22, 2026Laizhen Li, Xuan Wang, Peicheng Zhao +4MCP Security AI Agent Security
Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University +3
Zero-Trust Authorization and Discovery for Enterprise MCP
Sep 18, 2026Huan Li, Yuwei Wang, Srinivasan ManoharanMCP Security Tool Access Control for LLM Agents
PayPal Inc. USA
No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers
Sep 9, 2026Zehua Zhang, Jie Hu, Pratham Hegde +13MCP Security Software Vulnerability Detection
School of Computing and Augmented Intelligence, Arizona State University
Public-Sharing Labels and Verbatim Field Egress in an MCP-to-A2A Agent Configuration: A Controlled Multi-Model Study
Sep 1, 2026Arpan Kumar MahapatraMCP Security LLM Agent Security
Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap
Aug 30, 2026Ashok Subbabhatta GopalakrishnaAgent Communication Protocols MCP Security
independent researcher
TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers
Aug 24, 2026Mehrdad Rostamzadeh, Sidhant Narula, Mohammad Ghasemigol +1MCP Security AI Agent Security Benchmarks
Department of Computer Science Old Dominion University Norfolk, USA · School of Cybersecurity Old Dominion University Norfolk, USA
AEGIS: Preventing Cross-Domain Resource Abuse in MCP
Aug 20, 2026Shriti Priya, Teryl Taylor, Frederico AraujoAI Agent Security MCP Security
IBM Research, USA
When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling
Aug 18, 2026Rabimba Karanjai, Yang Lu, Nour Diallo +4MCP Security AI Agent Security
Larry · University of Houston, USA · PayPal AI Labs, USA +1
Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation
Aug 13, 2026Rana Muhammad Ahmed, Sabahat AbbasMCP Security LLM Agent Security
Department of Computer Science, Bahria University, Islamabad, Pakistan
A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem
Aug 11, 2026Suraj Kumar, Amy Wang, Srinivasan ManoharanMCP Security Tool-Use Authorization
Enterprise AI Platform Engineering
Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
Aug 6, 2026Leo Sambrook, Sampo SovioMCP Security AI Agent Security
Hardware Systems Security Lab (HSSL) Huawei Technologies & EPITA Helsinki, Finland
Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale
Jul 31, 2026Nicolás PadillaMCP Security Software Vulnerability Detection
CobaltoSec
Hybrid Analysis for Secure MCP Tool Use in LLM Agents
Jul 28, 2026Ping He, Yuexiang Xie, Yaliang Li +1MCP Security LLM Agent Security
Zhejiang University · Alibaba Group
ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems
Jul 20, 2026Om Narayan, Rashmi Jyoti, Ramkinker SinghMCP Security AI Agent Security
Computer Science New York University New York, USA · Cybersecurity University of Maryland, College Park MD, USA · Carnegie Mellon University Pittsburgh, USA
Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
Jul 7, 2026Mohammadreza RashidiAdversarial Attacks MCP Security
Department of Computer Science AI and Media Analysis Lab Berlin, Germany
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
Jun 27, 2026Ting LiuMCP Security LLM Agent Security
SymbolicLight Research Foshan, Guangdong, China
ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP
Jun 25, 2026Liwei Liu, Tianzhu Han, Zijian Liu +2Adversarial Attacks MCP Security
Shanghai Jiao Tong University · Shanghai, China
Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications
Jun 3, 2026Yutao Shi, Xiaohan Zhang, Xiangjing Zhang +5MCP Security AI Agent Security
Fudan University, China
Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices
May 24, 2026Dongxu YangLanguage Model-Based Control MCP Security
1DeepLethe
Attested Tool-Server Admission: A Security Extension to the Model Context Protocol
May 22, 2026Alfredo MetereMCP Security AI Agent Security
Enclawed LLC
When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
May 22, 2026Shi Liu, Xuehai Tang, Xikang Yang +4MCP Security LLM Agent Security
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
ADR: An Agentic Detection System for Enterprise Agentic AI Security
May 17, 2026Chenning Li, Pan Hu, Justin Xu +9MCP Security AI Agent Security
Uber Technologies, Inc., USA · Massachusetts Institute of Technology, USA · University of Oxford, United Kingdom
Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization
May 12, 2026Ying Li, Yanju Chen, Peiran Wang +4MCP Security Tool-Use Authorization
University of California, Los Angeles USA · University of California, San Diego USA · University of Texas at Arlington USA +1
MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents
Apr 30, 2026Haonan Li, Tianjun Sun, Yongqing Wang +1MCP Security Privacy Leakage in Language Models
Key Laboratory of Intraplate Volcanoes and Earthquakes (China University of Geosciences, Beijing), Ministry of Education, Beijing 100083, China · School of Geophysics and Information Technology, China University of Geosciences, Beijing 100083, China
CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systems
Apr 18, 2026İpek Abasıkeleş Turgut, Edip GümüşMCP Security LLM Security
Department of Computer Engineering, Faculty of Engineering and Natural Sciences, Iskenderun Technical University, Hatay, Türkiye · Department of Computer Engineering, Institute of Graduate Studies, Iskenderun Technical University, Hatay, Türkiye
Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives
Apr 18, 2026Daeyeon SonMCP Security AI Agent Security
Independent Researcher · Republic of Korea
MCPThreatHive: Automated Threat Intelligence for Model Context Protocol Ecosystems
Apr 15, 2026Yi Ting Shen, Kentaroh Toyoda, Alex LeungMCP Security AI Agent Security
Vulcan Research, AIFT

Oct 26, 2026J/K move · Enter open · S save

Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du

Michigan State University East Lansing, MI, USA · TikTok San Jose, CA, USA

Prompt Injection Attacks on AI Agents LLM Agent Safety MCP Security Indirect Prompt Injection

Open paper AskPDF arXiv

LLM agents increasingly access external tools through the Model Context Protocol (MCP), but the natural-language metadata used to describe those tools creates a prompt-injection surface. Within this established tool-poisoning surface, we study Log-To-Leak, an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call. Its payload targets the user query, MCP server name, server response, and agent response. We operationalize the injected directive through Trigger, Tool Binding, Justification, and Pressure, and separately measure call success, payload fidelity, and preservation of legitimate behavior. We evaluate five MCP servers and four LLM agents using five metrics spanning effectiveness, utility, and efficiency. Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%; 16 pairs have absolute target-task completion changes of at most 6.63 percentage points. Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions. These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.