Farooq Shaikh and Biagio Montaruli submitted a study on 2 November 2026 reporting that poisoned Model Context Protocol (MCP) content can trigger tool execution and secret exfiltration across agentic AI frameworks. Their arXiv abstract describes MCP as connecting language models to external tool providers while bringing attacker-controlled descriptions, schema fields and response data into model context without validation.[1]
The authors report using their open-source tool, mcpvenom, across 12 frameworks, 18 models and 45 attack scenarios, producing a 9,720-cell susceptibility matrix. They describe a dual oracle that confirms exfiltration through receipt of a canary HTTP request. Among cells labeled vulnerable, they report 64.9% dispatching an attacker tool call, 23.0% contacting an attacker endpoint and 12.1% verifiably exfiltrating a secret. These are distinct reported outcomes; a dispatched call alone does not establish secret delivery.[1]
The abstract attributes resistance primarily to models and says a code audit found no intentional defense across the twelve frameworks. A regular-expression description scanner reportedly rejected 20 of 45 scenarios at a 7.2% false-positive rate, supporting the authors’ characterization of metadata scanning as a partial control. These remain study claims, rather than independently reproduced findings.[1]
[1]: https://arxiv.org/abs/2611.03555
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
1f24f7b8609eef74c8598985676331225726e4c7667469ee7089020b6be87555
