A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the…
We haven't written up this one. arXiv cs.AI has the full story — the link below goes straight to it.
