mlsanityData to 7 Oct 2026

A First Look at the Security Issues in the Model Context Protocol Ecosystem

arXiv 2510.16558 ↗First posted 18 Oct 2025cs.CR cs.AIcited by 3

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

The Model Context Protocol (MCP) has emerged as a standard for connecting large language models (LLMs) with external tools. However, this MCP ecosystem introduces new security risks across hosts, servers, and registries. In this paper, we present the first cross-entity security study of MCP under a two-stage attack surface. At the registry-level, weak vetting and ownership checks allow adversarial or hijacked servers to enter hosts. After integration, attacker-controlled tool metadata can shape LLM reasoning and induce attacker-intended operations, which hosts execute without independent verification. Code-level vulnerabilities (e.g., code injection) are not required but can amplify attacker-controlled parameters into exploitation. We analyze 67,057 servers across six public registries and identify widespread conditions enabling server hijacking and invocation manipulation. We further implement MCPInspect, a pre-integration analysis tool that detects misleading tool metadata and exploitable code vulnerabilities, identifying 833 vulnerable servers and 18 with suspicious descriptions.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 26 of its 60 references that are in the map. First posted on arXiv 18 Oct 2025.

Builds on

26 of 60 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  2. 2025CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent13 Apr

Other references · 24

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  4. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  5. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  6. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  7. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  8. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  9. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  10. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  11. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 143
  12. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 122
12 more
  1. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 112
  2. 2023Backdoor Attacks for In-Context Learning with Language Modelscited by 92
  3. 2023Adversarial Demonstration Attacks on Large Language Modelscited by 58
  4. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 47
  5. 2019Small World with High Risks: A Study of Security Threats in the npm Ecosystemcited by 36
  6. 2024Securing Large Language Models: Threats, Vulnerabilities and Responsible Practicescited by 36
  7. 2023Demystifying RCE Vulnerabilities in LLM-Integrated Appscited by 35
  8. 2024Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applicationscited by 32
  9. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 32
  10. 2023DeceptPrompt: Exploiting LLM-driven Code Generation via Adversarial Natural Language Instructionscited by 31
  11. 2021What are Weak Links in the npm Supply Chain?cited by 16
  12. 2017Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abusecited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 2.

3 papers.

  1. 2025QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agentscited by 2
  2. 2026Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelinescited by 0
  3. 2026Zero-Trust Authorization and Discovery for Enterprise MCPcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
  2. 2026MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security
  3. 2026Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents
  4. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
  5. 2025MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers
  6. 2025Can LLM Infer Risk Information From MCP Server System Logs?
  7. 2025MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers
  8. 2026Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions