MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study
What it is
This paper presents the first cross-framework measurement study of Model Context Protocol (MCP) tool poisoning, utilizing a tool called mcpvenom to test 12 frameworks and 18 models against 45 attack scenarios. It establishes a 25-class root-cause taxonomy and confirms real-world execution risks, finding that while overall attack success is 22.9%, resistance is primarily model-dependent rather than framework-dependent.
The problem it solves
Existing benchmarks measure model compliance with poisoned instructions but fail to confirm real execution or exfiltration, leaving the actual security risk of MCP integrations unquantified.
What you could use it for
- Security auditing of agentic AI frameworks
- Evaluating LLM robustness against prompt injection via tool metadata
- Developing defensive strategies for MCP integrations
Why it matters
Provides empirical evidence that current agentic frameworks lack intentional defenses against MCP tool poisoning, highlighting a critical security gap where model behavior, not framework logic, determines safety.
Read the source ↗Back to the library →
Summary written by an AI model from the source; check the source before you rely on it.