Skip to content

Back to the catalog

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
arxiv.orgpaper

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem

A2M (Attraction-to-Manipulation) is a two-stage black-box framework for hijacking agents that use the Model Context Protocol to select tools from third-party MCP servers. The Attraction phase optimizes attacker-controlled tool metadata to raise invocation probability, while the Manipulation phase uses execution traces to craft adversarial tool outputs that steer agent behavior; on LiveMCPBench it achieves a 93.6% malicious tool invocation rate against GLM-4.6, inflates token cost 32.4x under a cognitive denial-of-service variant, and reaches a 74.4% mean attack success rate across information exfiltration, environment integrity compromise, and reasoning derailment, with partial transfer (63.6%/2.7x/24.5%) to four other models without re-optimization. The authors argue this exposes a semantic supply-chain risk in MCP tool ecosystems and call for stronger tool vetting and runtime isolation.

TL;DR A black-box two-stage attack (A2M) hijacks MCP agents via poisoned tool metadata and trace-optimized adversarial tool outputs, hitting 93.6% malicious invocation rate on GLM-4.6 and transferring across models.
Open original ↗
Document

What it is

A2M (Attraction-to-Manipulation) is a two-phase black-box attack framework from researchers at Shenzhen Institutes of Advanced Technology (CAS) and collaborators, targeting the tool-selection and tool-output channels of MCP-based agents. Code is public at github.com/Lilaizhen/A2M.

How it works

Phase I (Attraction) generates malicious tool name/description pairs using five persuasion strategies — Authority, Urgency, Comprehensiveness, Resource Optimality, and Security — via a generator LLM prompted per-strategy. Each candidate's selection rate is scored with Monte Carlo rollouts (K=3 trials) against a placeholder payload; candidates with nonzero selection become "elite seeds." Phase II (Manipulation) allocates payload-generation budget across elite seeds in proportion to their measured selection rates, then synthesizes attack payloads conditioned on the specific attack goal. An Analyzer-Optimizer loop inspects execution traces to diagnose failure modes (semantic ambiguity, safety refusal) and iteratively refines the payload rather than searching randomly.

flowchart LR
    A[5 persuasion strategies] --> B[Candidate name/desc pairs]
    B --> C{Monte Carlo rollout:\nselected?}
    C -->|rate = 0| D[Discard]
    C -->|rate > 0| E[Elite seed]
    E --> F[Payload generation\n proportional to selection rate]
    F --> G[Analyzer: diagnose trace]
    G --> H[Optimizer: refine payload]
    H --> G

Preconditions / Affected

Applies to agents that select tools from open, unvetted third-party MCP registries based on semantic name/description matching, and that treat tool return content as trusted environment feedback rather than untrusted input. The attacker needs only the ability to register a tool with controlled metadata and a controlled execution endpoint — no model weights, system prompt, or memory access — but is assumed able to run local rollouts against the victim or a surrogate model to get optimization signal.

Caveats

Full attack success (ASR: info exfiltration, environment integrity compromise, reasoning derailment) transfers much less reliably across models than mere tool invocation — direct optimization on GLM-4.6 hits 93.6% invocation / 74.4% ASR, but transferring the same optimized tool to four other models without re-tuning drops to 63.6% invocation / 24.5% ASR (cost inflation also falls from 32.4x to 2.7x). The paper itself notes this gap as a finding, not a limitation it apologizes for, but it means the headline numbers in the existing summary are per-model-optimized, not zero-shot-universal.

Technologies named here

Techniques named here

  • Attraction phase
  • Manipulation phase
  • Cognitive Denial of Service
  • Information Exfiltration
  • Environment Integrity Compromise
  • Reasoning Derailment
  • Cross-model transfer attack

Related in AI Security