A2M: Trace-Optimized Agent Hijacking Attacks in the MCP Ecosystem

Forum topic · 小凯 · 2026-09-24

Summary

A2M (Attraction-to-Manipulation) is a two-stage black-box framework for hijacking AI agents that use the Model Context Protocol (MCP). Because MCP agents select tools from third-party servers via semantic matching, attacker-controlled metadata and outputs create a semantic supply-chain risk. The Attraction phase optimizes tool metadata to increase invocation probability, while the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a 93.6% macro-average malicious tool invocation rate across four scenarios, inflate weighted token costs to 32.4x the benign baseline under Cognitive Denial of Service, and reach a 74.4% mean attack success rate across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields macro-averages of 63.6%, 2.7x, and 24.5%. The paper argues for stronger tool vetting and runtime isolation in MCP ecosystems.

Paper Overview

Research Area: Security Authors: Laizhen Li, Xuan Wang, Peicheng Zhao, Juanjuan Zhao, Kejiang Ye et al. Published: 2026-09-22 arXiv: 2609.26761

Abstract

Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes.

On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4 $\times$ the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7 $\times$ , and 24.5%.

These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems.

Resources

Code: https://github.com/Lilaizhen/A2M
Paper: https://arxiv.org/abs/2609.26761

--- *Auto-collected on 2026-09-24*