A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem

AI 导读

论文提出A2M框架，通过优化元数据和执行痕迹劫持MCP代理，实现高成功率攻击，揭示MCP生态系统的安全风险。

A2M introduces a two-stage framework to hijack MCP agents via metadata optimization and trace-based manipulation, demonstrating severe security vulnerabilities in the ecosystem.

重点速览

• A2M通过两阶段攻击劫持MCP代理，利用元数据优化和执行痕迹操控 A2M employs a two-stage framework to hijack MCP agents through metadata optimization and trace-based manipulation
• 实验显示攻击成功率高达74.4%，成本增加32.4倍 Experiments show 74.4% attack success rate and 32.4x cost increase
• 攻击可迁移至其他模型，无需重新优化 Attacks transfer to other models without re-optimization
• 暴露MCP生态中工具验证和运行隔离的不足 Reveals weaknesses in tool vetting and runtime isolation in MCP ecosystems

一句话：MCP生态系统需强化工具验证与运行隔离以防御代理劫持攻击。 / MCP ecosystems require enhanced tool vetting and runtime isolation to defend against agent hijacking.

推荐理由 揭示AI代理安全漏洞，提供防御框架设计思路，对系统安全研究有启发价值。