A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4× the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7×, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 14 of its 24 references that are in the map. First posted on arXiv 22 Sep 2026.
Builds on
14 of 24 references.
Closest ancestors · 6
Same direction, newest first
- 2025Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools25 Sep
- 2025Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem8 Sep
- 2025Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools4 Aug
- 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem31 May
- 2025MPMA: Preference Manipulation Attack Against Model Context Protocol16 May
- 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
Other references · 8
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,880
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
- 2023Detecting Language Model Attacks with Perplexitycited by 411
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP
- 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
- 2026When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
- 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security
- 2025LeechHijack: Covert Computational Resource Exploitation in Intelligent Agent Systems
- 2026MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security
- 2025MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers
- 2026A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms