MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study
The study reports successful MCP poisoning in 22.9% of tested cases, with secret theft verified in 12.1% of those successes.
The authors tested 12 frameworks, 18 models and 45 attack scenarios, checking actual tool execution and confirming secret exfiltration through HTTP receipts. Susceptibility varied sharply by model, while nine core frameworks showed similar success rates of 23–26%. A code audit found no intentional poisoning defenses in any of the 12 frameworks. A description scanner rejected 20 of 45 attack scenarios but had a 7.2% false-positive rate, making metadata scanning only a partial control.
ArXiv · AI/CL/LG's note
The authors tested 12 frameworks, 18 models and 45 attack scenarios, checking actual tool execution and confirming secret exfiltration through HTTP receipts. Susceptibility varied sharply by model, while nine core frameworks showed similar success rates of 23–26%. A code audit found no intentional poisoning defenses in any of the 12 frameworks. A description scanner rejected 20 of 45 attack scenarios but had a 7.2% false-positive rate, making metadata scanning only a partial control.
ArXiv · AI/CL/LG's note
score 5