OverServe 攻击框架：通过工具与提示词协同设计放大 SaaS Agent 资源消耗
OverServe: Resource Amplification Attacks on SaaS Agents via Tool--Prompt Co-Design
四个模型加九个基准，最大的 API 请求放大到了 93.88 倍，而且任务检查全过、MCP 扫描器全部没报。做 Agent 平台或 SaaS 计费的人应该看看，它指出了一个新风险面：Agent 自己决定何时停止，这个机制本身能被租户拿来刷你的资源。防御思路部分也写得具体。
一篇 arXiv 论文提出 OverServe，一个针对订阅制 SaaS Agent 的多智能体攻击框架。攻击原理是协同设计 MCP 状态工具和完成确认提示词：每次工具调用返回准确状态并正常终止，但 Agent 会在提示词驱动下反复检查未完成的条件，导致业务任务完成后仍持续消耗服务商资源。攻击者通过独立的工具审查和提示词审查来筛选工具-提示词对，测试用的工具规格在受评的 MCP 扫描器中均未触发告警。
实验覆盖 Qwen、Nemotron、DeepSeek、Sonnet 四个模型和九个基准中的任务，所有 OverServe 运行都通过了原始任务检查，意味着攻击不会破坏业务目标的伪装性。最大可将 API 请求放大 93.88 倍。由于订阅制下模型与工具调用不产生额外客户付费，这类放大会直接侵蚀 SaaS 服务商成本。
对部署 Agent 的服务方而言，这篇论文指向一个此前少有人覆盖的风险面：完成决策本身可以被恶意租户利用。防御思路需要从单纯检测恶意提示词，扩展到对工具返回状态与停止条件之间的一致性做约束，这也是 MCP 生态在安全审计上需要补的环节。
OverServe: Resource Amplification Attacks on SaaS Agents via Tool--Prompt Co-Design
Advances in large language models (LLMs) are enabling software-as-a-service (SaaS) providers to automate longer business workflows with agents. In subscription-based SaaS deployments, model and tool calls consume provider resources without additional customer payments. Because the agent autonomously decides when to stop, a malicious tenant can send a prompt to the agent, exploiting its completion decisions to extend execution and waste provider resources. In this paper, we present OverServe, a multi-agent framework for constructing such attacks against SaaS agents. OverServe co-designs Model Context Protocol (MCP) status tools and completion-confirmation prompts for the attacker. Each tool call returns accurate status and terminates normally, yet the agent may repeatedly check an unfinished condition to satisfy the prompt. This consumes the SaaS provider's resources even after the original business task is completed. OverServe constructs service-specific tool--prompt pairs and uses separate tool and prompt reviews to guide candidate pair selection. Tested tool specifications trigger no alerts in the evaluated MCP scanners. We evaluate Qwen, Nemotron, DeepSeek, and Sonnet on selected tasks from nine benchmarks. All OverServe runs pass the original task checks. OverServe can reach a maximal amplification of API requests by $93.88\times$ while preserving the original task goal and collateral checks.
This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include OverServe, MCP, AI安全, 智能体.
Primary source verification: published directly by arXiv: DeepSeek with first-party authority.