A2M optimizes a malicious MCP tool's own description until agents pick it 93.6% of the time.

arXiv 2609.26761 works in two stages: optimize the tool name and description for selection, then use execution traces to refine return values. 74.4% attack success across exfiltration, environment integrity and reasoning derailment, and 63.6% invocation when transferred to four other models with no re-optimization. Semantic tool selection is a supply chain surface. Pin third-party MCP servers, vet descriptions, and isolate tool output from agent control flow.