# Securing GenAI Multi-Agent Systems Against Tool Squatting: A Zero Trust Registry-Based Approach

arXiv: https://arxiv.org/abs/2504.19951 · HTML: https://mlsanity.com/paper/2504.19951/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 34 references that are in the map.
- First posted on arXiv 28 Apr 2025.

## Builds on (most cited first, 4 of 4)

- [Red-Teaming LLM Multi-Agent Systems via Communication Attacks](https://mlsanity.com/paper/2502.14847/) (2025)
- [LLM Multi-Agent Systems: Challenges and Open Problems](https://mlsanity.com/paper/2402.03578/) (2024)
- [Multi-Agent Systems Execute Arbitrary Malicious Code](https://mlsanity.com/paper/2503.12188/) (2025)
- [Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies](https://mlsanity.com/paper/2504.08623/) (2025)

## Built on by (most cited first, 18 of 18)

- [A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures](https://mlsanity.com/paper/2506.19676/) (2025)
- [A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control](https://mlsanity.com/paper/2505.19301/) (2025)
- [A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes](https://mlsanity.com/paper/2601.05293/) (2026)
- [ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control](https://mlsanity.com/paper/2506.01333/) (2025)
- [MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI](https://mlsanity.com/paper/2508.10991/) (2025)
- [From Glue-Code to Protocols: A Critical Analysis of A2A and MCP Integration for Scalable Agent Systems](https://mlsanity.com/paper/2505.03864/) (2025)
- [MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers](https://mlsanity.com/paper/2510.23673/) (2025)
- [Security Analysis of Agentic AI Communication Protocols: A Comparative Evaluation](https://mlsanity.com/paper/2511.03841/) (2025)
- [COALESCE: Economic and Security Dynamics of Skill-Based Task Outsourcing Among Team of Autonomous LLM Agents](https://mlsanity.com/paper/2506.01900/) (2025)
- [Agent Capability Negotiation and Binding Protocol (ACNBP)](https://mlsanity.com/paper/2506.13590/) (2025)
- [MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents](https://mlsanity.com/paper/2602.14281/) (2026)
- [From Logic Monopoly to Social Contract: Separation of Power and the Institutional Foundations for Autonomous Agent Economies](https://mlsanity.com/paper/2603.25100/) (2026)
- [Quantifying Conversation Drift in MCP via Latent Polytope](https://mlsanity.com/paper/2508.06418/) (2025)
- [ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems](https://mlsanity.com/paper/2604.04426/) (2026)
- [TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AI](https://mlsanity.com/paper/2606.15822/) (2026)
- [The Age of Sensorial Zero Trust: Why We Can No Longer Trust Our Senses](https://mlsanity.com/paper/2507.00907/) (2025)
- [AgentHub: A Registry for Discoverable, Verifiable, and Reproducible AI Agents](https://mlsanity.com/paper/2510.03495/) (2025)
- [MAIF: Enforcing AI Trust and Provenance with an Artifact-Centric Agentic Paradigm](https://mlsanity.com/paper/2511.15097/) (2025)

## Abstract (arXiv)

The rise of generative AI (GenAI) multi-agent systems (MAS) necessitates standardized protocols enabling agents to discover and interact with external tools. However, these protocols introduce new security challenges, particularly; tool squatting; the deceptive registration or representation of tools. This paper analyzes tool squatting threats within the context of emerging interoperability standards, such as Model Context Protocol (MCP) or seamless communication between agents protocols. It introduces a comprehensive Tool Registry system designed to mitigate these risks. We propose a security-focused architecture featuring admin-controlled registration, centralized tool discovery, fine grained access policies enforced via dedicated Agent and Tool Registry services, a dynamic trust scoring mechanism based on tool versioning and known vulnerabilities, and just in time credential provisioning. Based on its design principles, the proposed registry framework aims to effectively prevent common tool squatting vectors while preserving the flexibility and power of multi-agent systems. This work addresses a critical security gap in the rapidly evolving GenAI ecosystem and provides a foundation for secure tool integration in production environments.