MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers

档案区分来源方法阅读与既有目录信息；已经公开不代表完成独立证据复核或双语编辑复核。

测量构念

不调用被污染工具时，其元数据能否仍劫持智能体？

任务与样本

45个实际MCP服务器、353工具构造1,348例，采用三类人工攻击范式，测20种智能体设置。

判分与失效情形

按隐蔽攻击成功计，直接调用污染工具为失败。

系统条件

45服务器353工具构造1,348例，三类模板。

统计含义

来源报告的结果表述；这不等同于已确定运行次数、分母或估计方法： o1-mini所报攻击成功72.8%。 按隐蔽判据直接调用污染工具被记为失败（§4.1）。

效度与解释

人工通用模板不是针对防护自适应攻击，计分依赖隐蔽标准。

适用研究问题

模型建议：与AgentDojo、InjecAgent比较时保留元数据暴露及成功定义。

• MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · AbstractSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
• MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §2.3 Related BenchmarksSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
• MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §4.1 Experiment SettingsSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
• MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §5 DiscussionSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established