Breaking MCP with Function Hijacking Attacks: 70-100% Attack Success Rate on 5 Models
arXiv·high signal
New function hijacking attack (FHA) manipulates agentic model tool selection to force invocation of attacker-chosen functions. The attack is context-agnostic and produces universal adversarial functions that work across multiple queries—achieving 70-100% ASR on the BFCL dataset across 5 models including instructed and reasoning variants. Critical for anyone deploying MCP-based agents.