Risk Evaluation · Benchmark

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers

NUWA research note · independent review pending

First published: 2025-08-19Source checked: 2026-10-25

Original source ↗Cite this record ↓Cybersecurity →

NUWA Research Note

Research question Design and assumptions Source findings NUWA interpretation Limits and contrary evidence Research and decision relevance Institutions and roles Original resources

Model-assisted reading · Selected sections of the original full text or official article; a complete section-by-section audit remains pending.

At a glance

NUWA interpretation: metadata trust creates a surface distinct from tool-output injection.

Research question

Can poisoned tool metadata redirect agents even without invoking the poisoned tool?

Design and assumptions

1,348 test cases derive from 45 live MCP servers and 353 tools, using three human-defined attack paradigms and twenty agent settings.

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — Figure 1 — Figure 1 · Original figure 1. Read alongside the protocol scope and limitations below. Original figure and source ↗

Source findings

o1-mini’s reported attack success was 72.8%.

Direct invocation of the poisoned tool is labeled failure in the stealth-specific scoring, not success (§4.1).

NUWA interpretation

NUWA interpretation: metadata trust creates a surface distinct from tool-output injection.

Limits and contrary evidence

Human-defined generic templates are not adaptive defense-specific attacks; scoring depends on the benchmark’s stealth criterion.

Research and decision relevance

Model recommendation: preserve metadata exposure and success definition when comparing with AgentDojo or InjecAgent.

Precise source locations

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · AbstractSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §2.3 Related BenchmarksSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §4.1 Experiment SettingsSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §5 DiscussionSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established

Source checking, extraction, editorial approval and replication are recorded separately. Methodology →

Institutions and roles

Research by University of Science and Technology of China Beihang University

Authors (9)

Zhiqiang Wang · Yichao Gao · Yanting Wang · Suyuan Liu · Haifeng Sun · Haoran Cheng · Guanquan Shi · Haohua Du · Xiangyang Li

Evaluation protocols

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers →

Cite and reuse

Cite the original publication for its findings. Cite this NUWA record separately for its explanation and retained snapshot.

BibTeX ↓RIS ↓Record + source metadata · JSON ↓Reading coverage · JSON Suggest a correction

Original publication · BibTeX

@misc{mcptox,
  title = {MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers},
  url = {https://arxiv.org/abs/2508.14925},
  author = {Zhiqiang Wang and Yichao Gao and Yanting Wang and Suyuan Liu and Haifeng Sun and Haoran Cheng and Guanquan Shi and Haohua Du and Xiangyang Li},
  year = {2025},
  date = {2025-08-19},
  version = {arXiv:2508.14925v2},
  note = {arXiv:2508.14925v2}
}

NUWA record · BibTeX

@misc{mcptox-nuwa,
  title = {MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — NUWA research record},
  url = {https://whitzard.tech/en/nuwa/whitzard-index/work/mcptox/},
  version = {2026-10-29.1},
  organization = {NUWA Frontier AI Safety Lab},
  howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--mcptox.json},
  note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--mcptox.json.}
}

Evidence snapshot 2026-10-29.1 · Index updates · RSS

References

[1] Zhiqiang Wang, Yichao Gao, et al.. MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers. 2025-08-19. v2 ; arXiv:2508.14925v2, §§3.2–3.4, 4, 5
[2] Zhiqiang Wang, Yichao Gao, et al.. MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper. AAAI-26 proceedings, pp. 35811–35819 ; AAAI-26 original paper, p. 1, author affiliations 1–2; Abstract; §2.3 Related Benchmarks