MCP 工具投毒测量研究：12 框架 18 模型整体攻击成功率 22.9%
MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study
给做 MCP 智能体的开发者提个醒： researchers 实测 12 个框架都会中招，攻击成功率 22.9%，而且厂商全都拒绝了漏洞披露，防御基本只能靠模型自己。
一项覆盖 12 个 MCP 框架、18 个模型、45 种攻击场景的 9,720 单元测量研究，用 mcpvenom 工具和金丝雀 HTTP 回执双预言机验证真实执行。整体攻击成功率 22.9%，其中 12.1% 的易感单元可验证外泄密钥。模型间攻击成功率从 0.4% 到 49.7%，九个核心框架集中在 23% 到 26% 区间（卡方 p=0.91），说明抗性主要由模型决定。代码审计发现 12 个框架均无主动防御，正则描述扫描器能拦截 45 个场景中的 20 个、误报率 7.2%。
MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study
The Model Context Protocol (MCP) lets agentic AI frameworks connect language models to external tool providers, but it carries attacker-controlled content (tool descriptions, schema fields, and response data) into model context without validation. Prior benchmarks measure model compliance with poisoned instructions without confirming real execution. We present the first cross-framework measurement of MCP tool poisoning with real tool execution. A 25-class root-cause taxonomy unifies prior classifications, and the open-source tool mcpvenom drives a 9,720-cell susceptibility matrix across 12 frameworks, 18 models, and 45 attack scenarios, with a dual oracle that confirms exfiltration via canary HTTP receipt. The overall attack success rate is 22.9% (2,113 vulnerable cells). Of these, 64.9% dispatch an attacker tool call, 23.0% contact the attacker endpoint, and 12.1% verifiably exfiltrate a secret. Resistance is model-level: nine core frameworks cluster within 23 to 26% (chi-squared = 3.30, p = 0.91), and no framework implements intentional defense. Incidental framework properties mitigate in specific cases, and a regex description scanner rejects 20 of 45 scenarios at a 7.2% false-positive rate, so metadata scanning alone is a partial control. Model ASR ranges from 0.4% to 49.7%. Claude Opus 4.8 is vulnerable in 8 of 530 cells while issuing 223 explicit refusals. A code-level audit finds no intentional defense across twelve frameworks, and all five coordinated disclosures across four vendors were rejected.
