{"resourceId":"arxiv-2611-03555-mcp-tool-poisoning-cross-framework-measurement-20261102","versions":[{"version":"external-e8b27cc981840cada7b6022b82c2669feeb308ec3a7942950453b160c17ea2c8","resource":{"id":"arxiv-2611-03555-mcp-tool-poisoning-cross-framework-measurement-20261102","title":"arXiv 2611.03555 (AISec '26): MCP tool poisoning succeeds in 22.9% of 9,720 real-execution tests across 12 agent frameworks; metadata scanning is only a partial control","organization":"Farooq Shaikh and Biagio Montaruli (academic preprint, accepted at AISec '26 / ACM CCS 2026)","sector":"Academic AI security research","geography":"Framework-agnostic laboratory measurement; no jurisdiction","publishedAt":"arXiv v1 submitted Mon, 2 Nov 2026 18:17:08 UTC","publicationDate":"2026-11-02","eventDate":null,"sourceName":"arXiv","sourceLabel":"MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study","sourceUrl":"https://arxiv.org/abs/2611.03555","evidenceClass":"academic-research","outcomeClass":"cautionary","topics":["developers-agents","data-security"],"finding":"The authors measured MCP tool poisoning with real tool execution using an open-source tool (mcpvenom) across a 9,720-cell matrix: 12 frameworks, 18 models and 45 attack scenarios, with a dual oracle that confirms exfiltration through a canary HTTP receipt. Overall attack success was 22.9% (2,113 vulnerable cells). Of those, 64.9% dispatched an attacker tool call, 23.0% contacted the attacker endpoint and 12.1% verifiably exfiltrated a secret. Nine core frameworks clustered at 23–26% (chi-squared 3.30, p = 0.91), so resistance is model-level; model attack success ranged from 0.4% to 49.7%. A regex description scanner rejected 20 of 45 scenarios at a 7.2% false-positive rate. A code audit found no intentional defense in twelve frameworks, and all five coordinated disclosures to four vendors were rejected. It is newly relevant tonight because Palo Alto's Nov. 9 byline markets MCP tool-call inspection and skill scanning.","sledRelevance":"SLED developers and research groups wiring agents to MCP servers inherit this risk regardless of framework. Interpretation: the study gives buyers an independent way to test vendor MCP-inspection claims, since it shows scanning tool descriptions alone misses more than half of scenarios.","evidence":"Opened the arXiv abstract page and read the abstract, comments (accepted at AISec '26, co-located with ACM CCS 2026; 12 pages, 9 tables) and submission history (v1, 2 Nov 2026). Full PDF tables were not reviewed in this run; all figures come from the abstract.","architectureImplications":"Because resistance varies by model rather than framework, interpretation is that defenses must sit outside the model and framework, at runtime inspection of tool calls and egress, rather than in tool-description scanning alone.","governanceImplications":"All five coordinated disclosures were rejected by vendors, which suggests organizations cannot assume framework maintainers will add defenses; local allow-listing of MCP servers becomes a governance requirement.","securityPrivacyImplications":"Attacker-controlled tool descriptions, schema fields and responses enter model context without validation; 12.1% of vulnerable cells verifiably exfiltrated a secret.","caveats":"Preprint; peer review status is acceptance at a workshop. Results depend on the 45 chosen scenarios and 18 models. Only the abstract was inspected. It does not test any Palo Alto product. Counts are cells in a lab matrix, not field incidents.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: this independent Nov. 2 preprint gives customers a neutral reason to take MCP risk seriously: about one in five real-execution tests of tool poisoning succeeded across 12 agent frameworks. It also warns that description scanning alone stops fewer than half of scenarios. Use it to propose a test-based evaluation of any MCP security product, including Palo Alto's, rather than a feature comparison. Do not claim any product beats these numbers; the paper tested none.","engineering":"Engineering framing: the study uses real execution with a canary-receipt oracle, which is stronger than compliance-only benchmarks. Key numbers: 22.9% overall success, framework results clustered at 23–26%, model success from 0.4% to 49.7%, and a regex scanner blocking 20 of 45 scenarios at 7.2% false positives. Engineers can reuse the open-source tool to probe a pilot's MCP inspection and egress controls, while noting only the abstract was reviewed here.","delivery":"Delivery framing: fold the study's method into acceptance testing for agent deployments. Plan a small poisoning test set, run it before and after inspection controls are enabled, and record misses. Ownership sits with the security engineering team running the pilot. Risks include treating lab percentages as production predictions and the effort to maintain test scenarios as MCP servers change."},"roleDetails":{"sales":{"customerProblem":"Agent frameworks pass attacker-controlled MCP tool metadata into model context, and no tested framework defends against it intentionally.","stakeholders":["CISO","Application security lead","Research computing director","AI governance committee"],"discoveryQuestions":["Which MCP servers do your agents use, and who maintains them?","Do you test agents against poisoned tool descriptions?","What egress controls apply to agent hosts?"],"valueHypothesis":"Interpretation: an independent test harness can show whether a given control reduces poisoning success below the study's 22.9% baseline in the customer's own setup.","potentialEngagement":"A bounded MCP red-team exercise using the study's open-source approach against one pilot agent workflow.","unsupportedClaims":["That any Palo Alto product was tested","That lab success rates predict field incident rates","That framework choice reduces risk"]},"engineering":{"fit":"Applies to any team running tool-integrated LLM agents over MCP.","architectureIntegration":"Use runtime tool-call inspection and egress controls in addition to description scanning; the study's canary oracle can validate egress blocking.","prerequisites":["A non-production agent environment","Canary endpoint for exfiltration detection","Inventory of models and frameworks in use"],"constraints":["Only 45 scenarios","Results vary strongly by model","Abstract-level review only"],"security":"Poisoned descriptions, schema fields and responses can trigger attacker tool calls and secret exfiltration; regex scanning gives partial coverage with 7.2% false positives.","proofOfValue":["Measure poisoning success with and without the inspection control","Record false-positive rate of any scanner on legitimate tools","Verify canary exfiltration is blocked at egress"]},"delivery":{"work":"Build and maintain a poisoning test set and run it as a gate before agent workflows go live.","dependencies":["Security engineering time","Access to agent configurations","Agreement on acceptable residual risk"],"ownership":"Application security or security engineering team responsible for agent deployments.","skillsAdoption":"Teams need basic red-team skills for agent testing and an understanding of MCP metadata risks.","governanceCheckpoints":["Test results reviewed before production approval","Re-test when models or MCP servers change"],"acceptanceCriteria":["Proposed: documented poisoning test run for every production agent workflow","Proposed: no canary exfiltration in the final pre-production run"],"risks":["False confidence from metadata scanning","Test drift as tools change","Over-generalizing preprint figures"]}},"retrievedAt":"2026-11-10T04:04:15Z","enrichedAt":"2026-11-10T04:08:31Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Agent testing requires red-team skills many SLED teams lack; the open-source tool lowers the barrier but still needs trained staff.","procurementImplications":"Interpretation: RFPs for agent-security tools should require vendors to demonstrate results against a poisoning test set rather than list features.","operatingModelImplications":"Pre-production poisoning tests should become a standing gate, re-run when models or MCP servers change.","sourceVerification":{"openedUrl":"https://arxiv.org/abs/2611.03555","referenceExcerpt":"a regex description scanner rejects 20 of 45 scenarios at a 7.2% false-positive rate, so metadata scanning alone is a partial control","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}