A2M 攻击框架：MCP 智能体可被恶意工具元数据劫持
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
给 MCP 工具生态敲警钟的研究：攻击者光靠优化工具描述就能让 GLM-4.6 中招率超九成，做了 MCP 接入的都该看看
arXiv 论文提出 A2M（Attraction-to-Manipulation）两阶段黑盒攻击框架，针对使用 Model Context Protocol 的智能体。第一阶段优化工具元数据提高被调用概率，第二阶段利用执行轨迹优化恶意工具返回内容。在 LiveMCPBench 上对 GLM-4.6 优化后，恶意工具调用率达 93.6%，Cognitive DoS 场景下 token 成本升至良性基线的 32.4 倍，信息泄露等三类攻击平均成功率 74.4%。攻击迁移到其他四个模型无需重新优化，平均调用率 63.6%、成功率 24.5%。
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4$\times$ the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7$\times$, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.
