A2M 攻击框架：MCP 智能体可被恶意工具元数据劫持
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
给 MCP 工具生态敲警钟的研究：攻击者光靠优化工具描述就能让 GLM-4.6 中招率超九成，做了 MCP 接入的都该看看
arXiv 论文提出 A2M（Attraction-to-Manipulation）两阶段黑盒攻击框架，针对使用 Model Context Protocol 的智能体。
第一阶段优化工具元数据提高被调用概率，第二阶段利用执行轨迹优化恶意工具返回内容。在 LiveMCPBench 上对 GLM-4.
6 优化后，恶意工具调用率达 93.6%，Cognitive DoS 场景下 token 成本升至良性基线的 32.
4 倍，信息泄露等三类攻击平均成功率 74.4%。
攻击迁移到其他四个模型无需重新优化，平均调用率 63.6%、成功率 24.
5%。
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4$\times$ the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7$\times$, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.
This report is categorized under AITOP's "Papers" desk, focusing on China's AI industry and domestic foundation model ecosystem. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and AI regulation, compliance frameworks, and sovereign compute policy. Key entities and technical topics under continuous tracking include MCP and tools, agents, AI safety, GLM-4.6.
Source attribution: curated from arXiv cs.AI (@Laizhen Li, Xuan Wang, Peicheng Zhao, Juanjuan Zhao, Kejiang Ye, Cheng-zhong Xu, Xitong Gao).
