In a paper released on arXiv by cybersecurity researchers Farooq Shaikh and Biagio Montaruli, the authors presented the first comprehensive cross-framework measurement study of Model Context Protocol (MCP) tool poisoning. While prior research evaluated whether language models complied with poisoned instructions in isolated chat simulations, this study executed real tool dispatches and verified data exfiltration through live canary HTTP callback endpoints.
The researchers unified existing vulnerability taxonomies into a 25-class root-cause classification and introduced mcpvenom, an automated testing harness. The authors constructed an exhaustive 9,720-cell susceptibility matrix, evaluating 12 major agentic AI frameworks across 18 foundation models and 45 distinct attack scenarios encompassing description injection, schema poisoning, and post-connection rug-pull mutations.
Across the full evaluation matrix, the study documented an overall attack success rate (ASR) of 22.9%, representing 2,113 vulnerable cells. When an attack succeeded, 64.9% of instances resulted in the agent dispatching an unauthorized tool call, 23.0% made direct network contact with the adversary's command-and-control endpoint, and 12.1% verifiably exfiltrated sensitive environment variables or secrets to the attacker.
A critical finding of the research is that susceptibility is almost entirely governed by the underlying foundation model, not the agent framework. Susceptibility rates across nine core agent frameworks clustered tightly between 23% and 26% (chi-squared = 3.30, p = 0.91). An in-depth code audit of all twelve frameworks revealed that none implemented intentional defensive filtering against malicious metadata, leaving models completely exposed to raw tool descriptions.
Foundation models exhibited wide variations in baseline resistance, with model-level attack success rates spanning from 0.4% up to 49.7%. Claude Opus 4.8 demonstrated the highest defensive capability, falling prey to only 8 out of 530 test cells while issuing 223 explicit refusals upon detecting contradictory or suspicious instructions inside tool descriptors. Conversely, smaller open-weight models frequently adopted adversarial personas embedded within parameter descriptions.
The authors noted that simple regex-based metadata filters proved ineffective, blocking only 20 of the 45 attack vectors while producing a prohibitive 7.2% false-positive rate on legitimate enterprise API schemas. Alarmingly, the researchers disclosed that all five coordinated vulnerability reports submitted to four major framework vendors were rejected, underscoring an urgent industry-wide need for cryptographic manifest signing and strict privilege separation in agentic tool architectures.