A2M hijacks MCP agents through optimized tool metadata: 93.6% malicious-tool invocation and 32.4x token-cost inflation

arXiv 2609.26761·high signalXBlueskyLinkedInCopy link

A2M works in two stages. First it optimizes a malicious MCP tool's name and description so agents pick it (93.6% invocation on GLM-4.6 in LiveMCPBench). Then it uses execution traces to refine the tool's return values, reaching 74.4% attack success across exfiltration, environment-integrity and reasoning-derailment scenarios. Transferred to four other models without re-optimization, the attack still reached 63.6% invocation. The builder takeaway is that semantic tool selection is a supply-chain surface: pin and vet third-party MCP servers, and isolate tool outputs from agent control flow. Code is public.