MCP Security

MCP: Model Context Protocol

Follow this topic Ask about this topic

Momentum

2 papers in the last four weeks, down 50% on the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 23

All topics

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Sep 22, 2026Laizhen Li, Xuan Wang, Peicheng Zhao +4MCP Security AI Agent Security
Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University +3
No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers
Sep 9, 2026Zehua Zhang, Jie Hu, Pratham Hegde +13MCP Security Software Vulnerability Detection
School of Computing and Augmented Intelligence, Arizona State University
Public-Sharing Labels and Verbatim Field Egress in an MCP-to-A2A Agent Configuration: A Controlled Multi-Model Study
Sep 1, 2026Arpan Kumar MahapatraMCP Security LLM Agent Security
Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap
Aug 30, 2026Ashok Subbabhatta GopalakrishnaAgent Communication Protocols MCP Security
independent researcher
Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation
Aug 13, 2026Rana Muhammad Ahmed, Sabahat AbbasMCP Security LLM Agent Security
Department of Computer Science, Bahria University, Islamabad, Pakistan
A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem
Aug 11, 2026Suraj Kumar, Amy Wang, Srinivasan ManoharanMCP Security Tool-Use Authorization
Enterprise AI Platform Engineering
Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
Aug 6, 2026Leo Sambrook, Sampo SovioMCP Security AI Agent Security
Hardware Systems Security Lab (HSSL) Huawei Technologies & EPITA Helsinki, Finland
Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale
Jul 31, 2026Nicolás PadillaMCP Security Software Vulnerability Detection
CobaltoSec
Hybrid Analysis for Secure MCP Tool Use in LLM Agents
Jul 28, 2026Ping He, Yuexiang Xie, Yaliang Li +1MCP Security LLM Agent Security
Zhejiang University · Alibaba Group
ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems
Jul 20, 2026Om Narayan, Rashmi Jyoti, Ramkinker SinghMCP Security AI Agent Security
Computer Science New York University New York, USA · Cybersecurity University of Maryland, College Park MD, USA · Carnegie Mellon University Pittsburgh, USA
Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
Jul 7, 2026Mohammadreza RashidiAdversarial Attacks MCP Security
Department of Computer Science AI and Media Analysis Lab Berlin, Germany
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
Jun 27, 2026Ting LiuMCP Security LLM Agent Security
SymbolicLight Research Foshan, Guangdong, China
ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP
Jun 25, 2026Liwei Liu, Tianzhu Han, Zijian Liu +2Adversarial Attacks MCP Security
Shanghai Jiao Tong University · Shanghai, China
Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications
Jun 3, 2026Yutao Shi, Xiaohan Zhang, Xiangjing Zhang +5MCP Security AI Agent Security
Fudan University, China
Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices
May 24, 2026Dongxu YangLanguage Model-Based Control MCP Security
1DeepLethe
Attested Tool-Server Admission: A Security Extension to the Model Context Protocol
May 22, 2026Alfredo MetereMCP Security AI Agent Security
Enclawed LLC
When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
May 22, 2026Shi Liu, Xuehai Tang, Xikang Yang +4MCP Security LLM Agent Security
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
ADR: An Agentic Detection System for Enterprise Agentic AI Security
May 17, 2026Chenning Li, Pan Hu, Justin Xu +9MCP Security AI Agent Security
Uber Technologies, Inc., USA · Massachusetts Institute of Technology, USA · University of Oxford, United Kingdom
Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization
May 12, 2026Ying Li, Yanju Chen, Peiran Wang +4MCP Security Tool-Use Authorization
University of California, Los Angeles USA · University of California, San Diego USA · University of Texas at Arlington USA +1
MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents
Apr 30, 2026Haonan Li, Tianjun Sun, Yongqing Wang +1MCP Security Privacy Leakage in Language Models
Key Laboratory of Intraplate Volcanoes and Earthquakes (China University of Geosciences, Beijing), Ministry of Education, Beijing 100083, China · School of Geophysics and Information Technology, China University of Geosciences, Beijing 100083, China
CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systems
Apr 18, 2026İpek Abasıkeleş Turgut, Edip GümüşMCP Security LLM Security
Department of Computer Engineering, Faculty of Engineering and Natural Sciences, Iskenderun Technical University, Hatay, Türkiye · Department of Computer Engineering, Institute of Graduate Studies, Iskenderun Technical University, Hatay, Türkiye
Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives
Apr 18, 2026Daeyeon SonMCP Security AI Agent Security
Independent Researcher · Republic of Korea
Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines
Jan 30, 2026Saeid Jamshidi, Kawser Wazed Nafi, Arghavan Moradi Dakhel +2LLM Auditing MCP Security
SWAT Laboratory, Polytechnique Montr´eal, Montr´eal, Canada · SæT Laboratory, Polytechnique Montr´eal, Montr´eal, Canada

Sep 22, 2026, cs.CRJ/K move · Enter open · S save

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem

Laizhen Li, Xuan Wang, Peicheng Zhao, Juanjuan Zhao+3

Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University+3

MCP Security AI Agent Security Black-Box Adversarial Attacks

Open paper AskPDF arXiv

Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4

\times

the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7

\times

, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.

Momentum

Related topics

Latest papers 23