In the MCP agent setup evaluated by Laizhen Li and colleagues, the agent selects tools by semantic matching against third-party names and descriptions, then reads what those tools return. The study treats those two moments as separate attack objectives.

The A2M study was submitted on 22 September 2026 and is listed as accepted at AACL-IJCNLP 2026. Its framework optimises an attacker-controlled tool's metadata to win selection, then refines the returned content to steer the agent. The authors call this Attraction-to-Manipulation. The experiments ran on LiveMCPBench, a controlled benchmark. The paper reports no CVE or vendor fix.

Promptective has not independently reproduced these results.

Two boundaries in one tool call

The first boundary decides which tool runs. In the evaluated setup, the agent chooses among available MCP tools by semantic matching, so a tool's name and description shape the call before any code executes. Under the paper's threat model, an attacker who registers a tool controls both.

The second boundary decides what happens after the call. The paper reports that the evaluated agents treat tool returns as trusted environment feedback, so returned text carries more apparent authority than a web page in that setup.

Tool definitions and tool outputs both carry indirect prompt injection: untrusted text reaches the agent without the user typing it. The authors frame the tool channel as a semantic supply-chain risk and present separating attraction from manipulation as their contribution within that threat.

How a tool wins the call

In the Attraction phase, a generator produces candidate names and descriptions under five persuasion strategies, including authority, urgency and resource optimality. Candidates are ranked by selection frequency across three Monte Carlo rollouts.

Metadata optimised on ten base tasks still won invocations on 50 held-out queries, at 74.0% to 90.0% across the five models. In this setup, a description is a selection input, and review after invocation leaves the first boundary unmanaged.

What the returned content can do

The Manipulation phase shapes the return to read as a plausible response carrying instructions. An Analyzer-Optimizer loop reads the execution trace, diagnoses failures such as an ignored payload, and rewrites the tool.

The four scenarios:

Cognitive denial of service. Redundant reasoning loops or repeated calls inflate token consumption.
Information exfiltration. The agent collects local data, such as an API key, and passes it to the attacker's tool.
Environment integrity compromise. The agent writes attacker-specified configuration, such as registering another MCP server.
Reasoning derailment. The agent abandons the original task or moves to the wrong downstream tools.

This article describes structure only.

Direct optimisation and transfer

On GLM-4.6, where attacks were optimised and evaluated directly, the mean malicious tool invocation rate was 93.6% across four scenarios. The mean attack success rate was 74.4% across the three scenarios scored for completion. Under cognitive denial of service, weighted token costs rose to 32.4 times the benign baseline.

Transfer to Qwen3-Max, DeepSeek-V3.1, Kimi-K2-0905 and GPT-5 without re-optimisation produced a 63.6% mean invocation rate, a 24.5% mean success rate and a 2.7 times cost ratio. Invocation averages four scenarios, success three, and cost is a separate measure.

Invocation transfers more consistently than full success. GPT-5 shows the gap: invocation between 64.9% and 76.3%, no success in exfiltration or environment compromise, and 22.0% in derailment. Ignored payloads were the most common failure in unsuccessful GLM-4.6 attacks: 47.4% for exfiltration, 56.5% for environment compromise.

What the benchmark does not establish

LiveMCPBench contains 95 tasks, 70 MCP servers and 527 tools, run through a ReAct-style stack. The results are author-reported.

The threat model assumes the attacker can register a tool. The paper does not cover lower-level network or operating-system exploits or delayed long-horizon effects. The authors did not systematically vary system prompts, routing policies, safety wrappers or the competing tool pool.

These numbers describe a controlled benchmark. They are not a production breach rate, proof of universal susceptibility, or a patch advisory.

Controls that match the two boundaries

A FIDES-inspired defence treated tool returns as untrusted data and checked policy before later calls. It cut the cognitive-denial cost ratio from 32.4 to 9.0 times and success rates to 20.6% for exfiltration, 22.9% for environment compromise and 11.1% for derailment, while invocation stayed above 80%. Detection was weaker: a Qwen3-8B auditor flagged at most 32.5% of environment-compromise cases, and paraphrasing still left 72.5% average invocation.

For teams:

Vet tool metadata before it reaches an agent. Check names, descriptions and provenance.
Treat tool returns as untrusted input. Information-flow rules can keep returned text from gaining authority.
Enforce on the proposed operation. Evaluate the destination, data and scope before a call runs.
Budget loops and recursion. Cap repeated calls and token spend.
Measure invocation and success separately. A tool call is exposure; completion is impact.

The SiYuan MCP upload case shows why visible arguments still need enforced policy at the operation. The Amazon Kiro disclosure shows a related chain from repository content to local file access, a configuration change and an outbound request. See what prompt injection is and our prompt injection examples.

Applying policy at the action boundary

Promptective puts organisation policy at supported AI interaction and action boundaries. It detects prompt injection, secrets, PII, unsafe content and policy violations, then combines the finding with the proposed operation before returning an explicit outcome: allow, audit, sanitise, require approval or block.

For a chain like A2M, the decisive checkpoints are the tool the agent proposes to call and the operation the returned content proposes. Supported adapters enforce policy before tool execution. An application integrating policy decisions must withhold execution when approval is required and provide its own approval workflow.

Promptective produces content-minimised decision evidence: the applicable policy version, matched rules, finding stage and outcome. The owning application must separately record and verify approval and execution. The A2M benchmark did not test Promptective or establish protection against its scenarios.

Tool selection and tool returns are different trust boundaries. A control that covers one leaves the other open.

Sources

Li et al., A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem, arXiv preprint 2609.26761v1, submitted 22 September 2026.
Full paper, version 1, especially sections 3 to 5 and the limitations. Accessed 24 September 2026.

Prompt injection in MCP: first win the tool call, then redirect the agent