Hijacking MCP Agents: How A2M Exposes Semantic Supply-Chain Risks
破解 MCP 生態系：新型 A2M 攻擊框架揭示 AI Agent 的語意供應鏈安全威脅
As Model Context Protocol (MCP) gains traction, AI agents increasingly connect to third-party tool servers. Since MCP relies heavily on semantic matching to select tools, it introduces a semantic supply-chain risk. Researchers developed A2M (Attraction-to-Manipulation), a black-box framework that first optimizes tool metadata to attract agent invocations, and then refines adversarial tool returns based on execution traces. This successfully steers agent behavior, triggering reasoning derailment or cognitive denial of service.
Key points
Semantic Supply-Chain Threat
MCP agents rely on semantic matching to select tools, allowing malicious third-party tools to easily trick agents into invoking them through optimized descriptions.
Two-Stage A2M Framework
Consists of an 'Attraction' phase to optimize metadata, and a 'Manipulation' phase that leverages execution traces to refine adversarial tool returns.
High Hijacking Success
Achieved a 93.6% malicious tool invocation rate on GLM-4.6, with a 74.4% success rate across exfiltration and reasoning derailment tasks.
Cognitive Denial of Service
By manipulating tool returns, the attack traps agents in infinite loops, ballooning weighted token costs to 32.4 times the baseline.
How it works
Why it matters
This research demonstrates that LLM reasoning alone cannot guard against adversarial third-party tools. As MCP gains mainstream adoption, these findings force developers to abandon the assumption of trust in tool metadata, driving the adoption of strict tool vetting and runtime sandboxing in enterprise-level agent architectures.
Who it affects
- AI Developer
- AI Researcher
- Enterprise Leader
How to use it
- 1Agent Red Teaming: Using the A2M framework to stress-test enterprise MCP agents and evaluate their resilience against adversarial tools.
- 2Defense Mechanism Design: Developing semantic filters to screen MCP tool metadata and block maliciously optimized descriptions.
Limitations & caveats
- The transferability of the black-box attack on non-target optimized models shows a decrease in success rate (from 74.4% down to 24.5%).
- Strict dynamic permission prompts and metadata obfuscation in deployment environments could severely limit the attack's efficacy.