SOURCE-LINKED INTELLIGENCE

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem

arXiv · AI, language, vision and robotics · article · Sep 22, 2026 · UTC

Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a mac

Read original source ↗ Open in workspace

recordType

paper

region

Global