风险评测 · 评测基准

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers

NUWA 研究解读 · 独立复核待完成

首次发表: 2025-08-19来源核验: 2026-10-25

原始来源 ↗引用本记录 ↓网络安全 →

NUWA Research Note

研究问题研究设计与假设来源发现 NUWA 解读局限与相反证据研究与决策意义机构与角色原始资源

模型辅助整理 · 选读原始全文或官方文章中的相关章节；尚未完成逐章节审计。

研究速读

NUWA 解读：元数据信任形成不同于工具输出注入的攻击面。

研究问题

不调用被污染工具时，其元数据能否仍劫持智能体？

研究设计与假设

45个实际MCP服务器、353工具构造1,348例，采用三类人工攻击范式，测20种智能体设置。

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — Figure 1 — Figure 1 · 原文 Figure 1。请结合下方的协议范围与局限阅读。原图与来源 ↗

来源发现

o1-mini所报攻击成功72.8%。

按隐蔽判据直接调用污染工具被记为失败（§4.1）。

NUWA 解读

NUWA 解读：元数据信任形成不同于工具输出注入的攻击面。

局限与相反证据

人工通用模板不是针对防护自适应攻击，计分依赖隐蔽标准。

研究与决策意义

模型建议：与AgentDojo、InjecAgent比较时保留元数据暴露及成功定义。

精确来源位置

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · AbstractSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §2.3 Related BenchmarksSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §4.1 Experiment SettingsSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established
MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper · §5 DiscussionSelected original resource https://arxiv.org/html/2508.14925; sha256:e7326aefa910c4da3b99e93cb2f3defdd93d48c927bf7a89ca3d9c54ec1f89c0; archived source capture; exact capture time not independently established

来源核查、数据提取、编辑批准与实验复现分别记录。方法说明 →

机构与角色

研究机构中国科学技术大学北京航空航天大学

作者 (9)

Zhiqiang Wang · Yichao Gao · Yanting Wang · Suyuan Liu · Haifeng Sun · Haoran Cheng · Guanquan Shi · Haohua Du · Xiangyang Li

评测协议

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers →

引用与复用

引用研究发现时请引用原始出版物；引用 NUWA 的整理与解释时，单独引用本站记录及对应快照。

BibTeX ↓RIS ↓记录与来源元数据 · JSON ↓阅读覆盖 · JSON 提交更正

原始出版物 · BibTeX

@misc{mcptox,
  title = {MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers},
  url = {https://arxiv.org/abs/2508.14925},
  author = {Zhiqiang Wang and Yichao Gao and Yanting Wang and Suyuan Liu and Haifeng Sun and Haoran Cheng and Guanquan Shi and Haohua Du and Xiangyang Li},
  year = {2025},
  date = {2025-08-19},
  version = {arXiv:2508.14925v2},
  note = {arXiv:2508.14925v2}
}

NUWA 记录 · BibTeX

@misc{mcptox-nuwa,
  title = {MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — NUWA research record},
  url = {https://whitzard.tech/nuwa/whitzard-index/work/mcptox/},
  version = {2026-10-29.1},
  organization = {NUWA Frontier AI Safety Lab},
  howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--mcptox.json},
  note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--mcptox.json.}
}

证据快照 2026-10-29.1 · 索引更新 · RSS

参考文献

[1] Zhiqiang Wang, Yichao Gao 等. MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers. 2025-08-19. v2 ; arXiv:2508.14925v2, §§3.2–3.4, 4, 5
[2] Zhiqiang Wang, Yichao Gao 等. MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — AAAI-26 paper. AAAI-26 proceedings, pp. 35811–35819 ; AAAI-26 original paper, p. 1, author affiliations 1–2; Abstract; §2.3 Related Benchmarks