Skip to content

Back to the catalog

ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP
arxiv.orgpaper

ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

ShareLock is a novel Tool Poisoning Attack against the Model Context Protocol that uses Shamir's secret-sharing scheme to split a malicious instruction into benign-looking fragments distributed across multiple tool descriptions, evading detectors that look for monolithic malicious text in a single tool. A covert trigger planted during a server update reconstructs the hidden instruction, and the authors report over 90% attack success across mainstream LLMs and two MCP clients while evading tool-description-based detection far better than prior single-tool poisoning approaches.

TL;DR A Shamir's-secret-sharing-based multi-tool MCP poisoning attack that hides malicious instructions across benign-looking tool descriptions, achieving >90% attack success while evading detection.
Open original ↗
Document

What it is

ShareLock (arXiv:2606.27027, Liu et al., Shanghai Jiao Tong University) is a multi-tool Tool Poisoning Attack against MCP that adapts Shamir's threshold secret-sharing to split a malicious prompt into benign-looking "shares" spread across several tool descriptions. The summary has the premise; the paper adds the concrete evaluation surface, the named defenses it defeats, and the threshold property that the summary glosses.

How it works

The malicious instruction p_adv is embedded into tool descriptions during MCP registration, where p_desc ⊆ p_system — so poisoned descriptions become part of the system prompt. Instead of one plaintext payload, ShareLock encodes p_adv as a degree-(k−1) polynomial whose constant term is the secret, then distributes n points as shares across tools. Reconstruction requires a threshold of k shares via Lagrange interpolation. Two consequences the summary omits:

  • Information-theoretic secrecy: fewer than k shares reveal nothing, so a reviewer or guard model auditing any single tool sees only benign metadata.
  • Fault tolerance: because only k of n shares are needed, the attack still fires even if some poisoned tools are removed by vetting.

A reconstruction trigger is planted covertly via a server update; once aggregated, the shares rebuild the instruction and drive unauthorized file operations or data exfiltration.

The paper also frames the taxonomy it operates in: Tool Description Poisoning (TDPA, registration-phase) vs. Tool Return Poisoning (TRPA, invocation-phase); ShareLock is TDPA.

Preconditions / Affected

The threat model assumes "moderate vetting" — human review plus automated scanners, not a fully adversarial audit. It requires the victim to connect to an attacker-controlled server (negligence or supply-chain compromise) and the ability to push a later server update carrying the trigger. Named as defeated: automated scanners MCPSafetyScanner and MCP-Guard, with MCP Guardian and MCIP discussed as the broader defense landscape.

Evaluation specifics

  • Clients tested: Cherry Studio and Cline (the summary says only "two clients").
  • Four LLMs; four multi-tool domains: Travel, Coding, Finance, Office.
  • Average Attack Success Rate >90%, outperforming single-tool baselines on tool-description detection.
  • Cited context: Zhao et al. report 78.5% of MCP servers contain at least one threat-relevant tool.

Caveats

The ASR is an average across models/domains, not a floor; per-model breakdowns are not in the fetched text. The listed defenses are described from the authors' framing, and the paper is a preprint (Conference'17 placeholder, 2026) — figures for stealth against specific guard models aren't quantified in the excerpt.

Organisations named here

  • Shamir's Secret Sharing

Technologies named here

  • ShareLock
  • Model Context Protocol
  • LLM

Techniques named here

  • Tool Poisoning Attack
  • Multi-tool threshold poisoning

Related in AI Security