Abstract
Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage black-box framework for hijacking MCP agents. The Attraction phase optimizes tool metadata to increase invocation probability; the Manipulation phase uses execution traces to refine adversarial tool returns that steer agents toward attacker-desired outcomes. On LiveMCPBench, direct attacks optimized and evaluated on GLM-4.6 achieve a macro-average malicious tool invocation rate of 93.6% across four scenarios, increase weighted token costs to 32.4$\times$ the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across Information Exfiltration, Environment Integrity Compromise, and Reasoning Derailment. Transfer to four other models without re-optimization yields corresponding macro-averages of 63.6%, 2.7$\times$, and 24.5%. These findings motivate stronger tool vetting and runtime isolation in MCP ecosystems. Code is publicly available at https://github.com/Lilaizhen/A2M.
Keywords
Subject
Publication details
- Journal
- Not available
- Open access
- Green open access
Cite this article
APA 7
Li, L., Wang, X., Zhao, P., Zhao, J., Ye, K., Xu, C., & Gao, X. (2026). A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem. https://omanscience.com/en/articles/a2m-trace-optimized-agent-hijacking-in-the-mcp-ecosystem
MLA 9
Li, Laizhen, et al. "A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem." https://omanscience.com/en/articles/a2m-trace-optimized-agent-hijacking-in-the-mcp-ecosystem.
Chicago (author–date)
Li, Laizhen, Xuan Wang, Peicheng Zhao, Juanjuan Zhao, Kejiang Ye, Chengzhong Xu, and Xitong Gao. 2026. "A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem." https://omanscience.com/en/articles/a2m-trace-optimized-agent-hijacking-in-the-mcp-ecosystem.
Harvard
Li, L., Wang, X., Zhao, P., Zhao, J., Ye, K., Xu, C. and Gao, X. (2026) 'A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem', Available at: https://omanscience.com/en/articles/a2m-trace-optimized-agent-hijacking-in-the-mcp-ecosystem.
Vancouver
Li L, Wang X, Zhao P, Zhao J, Ye K, Xu C, et al. A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem. https://omanscience.com/en/articles/a2m-trace-optimized-agent-hijacking-in-the-mcp-ecosystem
IEEE
L. Li, X. Wang, P. Zhao, J. Zhao, K. Ye, C. Xu, and X. Gao, "A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem," https://omanscience.com/en/articles/a2m-trace-optimized-agent-hijacking-in-the-mcp-ecosystem.