A study of AI assistants that use outside tools found a two-step way to divert them: make a malicious tool look useful, then put instructions in its response. In a 95-task benchmark, the attack often persuaded agents to call the tool. Whether they went on to carry out the attack varied sharply by model.
Model Context Protocol, or MCP, connects an AI assistant to external services through tools with names and descriptions. An agent may select a tool because its description appears to fit the user's task. The researchers' A2M method first tunes that description to attract a call, then refines the tool's returned text using a record of the agent's actions. The user need not issue a malicious request: in the study's threat model, the attacker controls a third-party tool's metadata and output.
Calling the tool was not the same as obeying it
The team tested A2M with a LangChain-based agent on LiveMCPBench, which contains 95 tasks spanning six domains. The attacks were optimized and evaluated on GLM-4.6, then tried on four other models without further tuning. Four scenarios measured whether the agent called the malicious tool; three also measured whether it completed the attacker's objective, such as disclosing information, changing its MCP server configuration or failing the original task.
On GLM-4.6, the agent called the malicious tool in an average 93.6% of the four scenarios. Across the three scenarios with a completion measure, average attack success was 74.4%. The fourth scenario, designed to waste computation, drove weighted token use to 32.4 times the benign-task baseline. That ratio is a study-defined cost estimate based on input and output tokens, not a measured customer bill.
The gap widened when the same attacks were transferred to the other four models: malicious tool calls averaged 63.6%, while completed attacks averaged 24.5% across the three applicable scenarios. For GPT-5 at medium reasoning effort, the malicious tool was called in 64.9% to 76.3% of tasks depending on the scenario, yet the study reported no completed information-disclosure or environment-change attacks and a 22.0% rate for task derailment. Selecting a tool, then, was a weaker signal of compromise than the subsequent behavior.
The attack was tested with a substituted tool
The researchers replaced a benign tool with an attacker-controlled one inside a benchmark agent. They scored completed attacks from records of agent actions with a separate language-model judge under a fixed rubric. The benchmark shows agents sometimes followed instructions in an attacker-controlled tool response; it does not measure how often this happens in deployed assistants. It also leaves open how other agent designs, tool-vetting rules and runtime controls would change the outcome.
Sources
- A2M research paper, arXiv:2609.26761, submitted September 22, 2026
- Full paper, including experimental setup and Table 1
- Research code repository
- Lead image: Figure 1 from the A2M paper by Laizhen Li and colleagues, CC BY 4.0.