{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"mcptox","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","aliases":[],"authors":["Zhiqiang Wang","Yichao Gao","Yanting Wang","Suyuan Liu","Haifeng Sun","Haoran Cheng","Guanquan Shi","Haohua Du","Xiangyang Li"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"benchmark","sourceId":"mcptox-publication","attributionSourceId":"mcptox-aaai-author-source","originalUrl":"https://arxiv.org/abs/2508.14925","publicationDate":"2025-08-19","updatedOn":"2026-10-25","areas":["cybersecurity"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":["mcptox"],"contributions":[{"organizationId":"ustc","role":"research","sourceId":"mcptox-aaai-author-source","locator":"AAAI-26 original paper, p. 1, author affiliations 1–2"},{"organizationId":"beihang","role":"research","sourceId":"mcptox-aaai-author-source","locator":"AAAI-26 original paper, p. 1, author affiliations 1–2"}],"summary":{"en":"Studies tool-poisoning attacks against agents using MCP servers and evaluates instruction following under adversarial tool metadata.","zh":"研究使用 MCP 服务的智能体遭受工具投毒的情况，评测对抗工具元数据下的指令执行。"},"note":{"question":{"en":"Can malicious instructions in MCP tool descriptions redirect an agent that is handling a legitimate user request?","zh":"MCP 工具描述中的恶意指令，能否使处理正常用户请求的智能体偏离目标？"},"method":{"en":"MCPTox pairs benign queries with poisoned tool metadata in MCP-server environments. Test cases are generated with model assistance and manual refinement, then evaluated through the agent’s resulting tool calls.","zh":"MCPTox 在 MCP 服务器环境中将正常查询与被污染的工具元数据配对。测试案例由模型辅助生成并经人工修订，再通过智能体产生的工具调用评估。"},"finding":{"en":"The evaluated agents are vulnerable to description-level tool poisoning under the tested conditions. The attack can redirect the use of legitimate tools, so avoiding execution of the poisoned tool itself does not remove the threat.","zh":"在所测条件下，被测智能体会受到描述层工具投毒影响。攻击可使正常工具的使用偏离目标，因此不执行被污染工具本身并不能消除威胁。"},"supports":{"en":"Tool metadata is a relevant untrusted-input boundary for agent evaluations, separate from prompt injection in tool execution results.","zh":"工具元数据是智能体评估中值得单独检查的不可信输入边界，与工具执行结果中的提示注入有所不同。"},"limits":{"en":"The payloads follow human-designed paradigms and semi-automated construction, rather than an adaptive search against every defense. Reported outcomes depend on the tested servers, agent setup and available tool permissions.","zh":"载荷采用人工设计范式与半自动构建，并非针对每种防御进行自适应搜索。报告结果依赖所测服务器、智能体配置和可用工具权限。"},"connections":null},"resources":[],"noteStatus":{"question":"verified","method":"verified","finding":"verified","supports":"verified","limits":"verified","connections":"limited"},"noteAvailability":{"en":"The substantive sections shown here were checked against the original source. Unfilled sections are omitted; source checking is not experimental replication.","zh":"此处展示的实质性章节已对照原始来源核查；未完成的章节已省略。来源核查不等于实验复现。"},"noteSourceLocator":"arXiv:2508.14925v2, §§3.2–3.4, 4, 5","tags":[]},"reading":{"id":"mcptox","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","en":{"question":"Can poisoned tool metadata redirect agents even without invoking the poisoned tool?","design":"1,348 test cases derive from 45 live MCP servers and 353 tools, using three human-defined attack paradigms and twenty agent settings.","findings":["o1-mini’s reported attack success was 72.8%.","Direct invocation of the poisoned tool is labeled failure in the stealth-specific scoring, not success (§4.1)."],"interpretation":"NUWA interpretation: metadata trust creates a surface distinct from tool-output injection.","limits":"Human-defined generic templates are not adaptive defense-specific attacks; scoring depends on the benchmark’s stealth criterion.","decisionRelevance":"Model recommendation: preserve metadata exposure and success definition when comparing with AgentDojo or InjecAgent.","takeaway":"NUWA interpretation: metadata trust creates a surface distinct from tool-output injection.","connections":[],"scoring":"Stealth-specific attack success; calling the poisoned tool directly is a failure.","conditions":"1,348 cases from 45 MCP servers/353 tools; three template paradigms.","statistics":"o1-mini’s reported attack success was 72.8%. Direct invocation of the poisoned tool is labeled failure in the stealth-specific scoring, not success (§4.1).","usage":"Model recommendation: preserve metadata exposure and success definition when comparing with AgentDojo or InjecAgent."},"zh":{"question":"不调用被污染工具时，其元数据能否仍劫持智能体？","design":"45个实际MCP服务器、353工具构造1,348例，采用三类人工攻击范式，测20种智能体设置。","findings":["o1-mini所报攻击成功72.8%。","按隐蔽判据直接调用污染工具被记为失败（§4.1）。"],"interpretation":"NUWA 解读：元数据信任形成不同于工具输出注入的攻击面。","limits":"人工通用模板不是针对防护自适应攻击，计分依赖隐蔽标准。","decisionRelevance":"模型建议：与AgentDojo、InjecAgent比较时保留元数据暴露及成功定义。","takeaway":"NUWA 解读：元数据信任形成不同于工具输出注入的攻击面。","connections":[],"scoring":"按隐蔽攻击成功计，直接调用污染工具为失败。","conditions":"45服务器353工具构造1,348例，三类模板。","statistics":"o1-mini所报攻击成功72.8%。 按隐蔽判据直接调用污染工具被记为失败（§4.1）。","usage":"模型建议：与AgentDojo、InjecAgent比较时保留元数据暴露及成功定义。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"mcptox-aaai-author-source","url":"https://arxiv.org/html/2508.14925","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established","artifactSha256":"e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0"},{"sourceId":"mcptox-aaai-author-source","url":"https://arxiv.org/html/2508.14925","locator":"§2.3 Related Benchmarks","version":"Selected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established","artifactSha256":"e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0"},{"sourceId":"mcptox-aaai-author-source","url":"https://arxiv.org/html/2508.14925","locator":"§4.1 Experiment Settings","version":"Selected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established","artifactSha256":"e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0"},{"sourceId":"mcptox-aaai-author-source","url":"https://arxiv.org/html/2508.14925","locator":"§5 Discussion","version":"Selected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established","artifactSha256":"e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"0f55ce7ebaf84e76c8f52a99f8796da1e9bd394bac6e4dec30ae213bba7dc981"}},"sources":[{"id":"mcptox-publication","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","url":"https://arxiv.org/abs/2508.14925","version":"arXiv:2508.14925v2","publicationDate":"2025-08-19","datePrecision":"day","type":"paper","verifiedOn":"2026-10-25","documentId":"arxiv:2508.14925","authors":["Zhiqiang Wang","Yichao Gao","Yanting Wang","Suyuan Liu","Haifeng Sun","Haoran Cheng","Guanquan Shi","Haohua Du","Xiang-Yang Li"],"aliases":["https://doi.org/10.48550/arXiv.2508.14925","https://arxiv.org/abs/2508.14925","https://arxiv.org/pdf/2508.14925"]}]}