Jul 2026· ACM Transactions on Software Engineering and Methodology· 0 citations· 50 references
TL;DR
Puppet is developed, the first automated security evaluation framework that enriches benign tool descriptions through selective requirement engineering to maximize semantic expressiveness, restructures them into LLM-preferred formats using description schema transformation, and applies name prioritization to introduce complementary lexical bias.
Abstract
The model context protocol (MCP) has rapidly emerged as a standard framework for integrating large language models (LLMs) with external tools and resources. However, its metadata-driven and non-deterministic tool selection mechanism introduces a previously overlooked security threat. Leveraging this weakness, we uncover the confused deputy attack, where an adversarial server with subtly manipulated metadata covertly overshadows a benign one, intercepting tool invocations without exhibiting overtly malicious behavior. To systematically study this threat, we develop Puppet, the first automated security evaluation framework that: (i) enriches benign tool descriptions through selective requirement engineering to maximize semantic expressiveness, (ii) restructures them into LLM-preferred formats using description schema transformation, and (iii) applies name prioritization to introduce complementary lexical bias. Furthermore, Puppet synthesizes valid user queries to enable systematic attack evaluation. We comprehensively evaluate Puppet across 14 models from 6 providers on 2 MCP hosts, demonstrating tool selection hijacking rates up to 90.89% and end-to-end malicious payload execution rates up to 86.46%, while remaining undetectable by representative security scanners (MCP-Scan and McpSafetyScanner), which are architecturally incapable of detecting metadata-level manipulation attacks. Counterintuitively, we find that reasoning-enabled models are significantly more vulnerable than their non-reasoning counterparts. Our findings expose a critical design-level attack surface in the MCP ecosystem and highlight the urgent need for principled security safeguards.
AEGIS is presented, a policy enforcement component that enables administrators to define fine-grained safeguards against resource abuse across heterogeneous MCP tools and modalities and detects and mitigates abusive behaviors while preserving the flexibility of MCP-based agent ecosystems.
S. Priya, Teryl Taylor, F. Araujo· 2026 56th Annual IEEE Intern...· 0 citations
This work proposes Architectural Intent Collapse (AIC), a formal framework capturing the systematic loss of communicative intent when text from heterogeneous sources is flattened into a single context window, and introduces Intent Separation Degree (ISD) as a measurable metric.
Zhaowen Feng, Zhenhui Liu, Ming-Jun Ma et al.· Electronics· 0 citations
- The rapid explosion of web application capabilities over the past ten years has fundamentally redesigned how applications are delivered, simultaneously introducing an intricate, multifaceted attack surface that continues to evolve. Standard vectors, long thought to be understood — such as SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) — still exist as potent hazards, yet they are increasingly overshadowed. Emerging cloud-native architectures, serverless delivery mechanisms, microservices, and AI-driven automation introduce entirely new categories of subtle, deeply embedded vulnerabilities. This research evaluates how these threats have metastasized and traces the origins of modern security vectors to determine if established defensive protocols remain effective against increasingly complex modern exploitation tactics. We conducted a strict Systematic Literature Review (SLR) structured by PRISMA 2020 guidelines, filtering an extensive initial pool of 885 records down to 62 core sources published between 2015 and 2026. This foundational dataset synthesizes observations from 44 peer-reviewed empirical studies alongside analysis from 18 key cybersecurity frameworks and official threat intelligence reports, incorporating guidance from standards bodies including OWASP, NIST, and ISO/IEC. The synthesized evidence reveals a definitive and strategic maturation in adversarial approach: threat actors are abandoning isolated, single-vulnerability exploits. They are instead executing prolonged, multi-stage campaigns that specifically leverage the trust relationships found in interconnected software ecosystems. While SQLi, XSS, and authentication weaknesses remain critical and frequent (identified within our 12 primary attack categories), a steep rise in complex, multi-stage exploit chains, AI-assisted reconnaissance, API breaches, and software supply chain compromises represents the new operational normal for adversaries. Furthermore, our analysis indicates that traditional defensive frameworks like secure development lifecycles, Zero Trust Architecture, DevSecOps, and Web Application Firewalls (WAFs) are no longer sufficient in isolation. Their mitigation capacity works only when supported by continuous, real-time context-aware monitoring and truly dynamic risk management, establishing an empirical baseline for architecting resilient security posturing that can keep pace with accelerating innovation.
Irene I. Eda, Jose Marcelito D. Brigoli, Teodoro B. Comayas Jr. et al.· Iconic research and engineer...· 0 citations
The Model Context Protocol (MCP) has emerged as the standard layer connecting Large Language Model agents to external tool backends. This openness introduces a severe server-side threat we term TrustShift: a compromised MCP server behaves benignly during an initial conditioning phase, building operational reliance and suppressing agent skepticism, before switching to an adversarial payload once an interaction threshold is reached. The evasion is temporal, not syntactic: benign at deploy time, the server's defection is invisible to predeployment static analysis, which sees only the honest phase. Switched payloads range from overt structural violations to schema-valid manipulations, the latter preserving outer protocol compliance to evade runtime middleware filters. Crucially, TrustShift originates in the server-controlled tool channel, not user prompts (unlike indirect prompt injection) or the transport (unlike man-in-the-middle): the adversary is the trusted server endpoint itself. We introduce TrustShiftProbe, an evaluation and defense framework with four contributions: (1) a stateful temporal threat model of the agent-server lifecycle as a benign conditioning phase followed by an adversarial defection at a trust horizon; (2) a language-agnostic attack engine that instantiates each variant as a compromised MCP server across four production domains; (3) SHIELD, a multi-tier, zero-oracle runtime defense at the MCP transport boundary that audits server payloads against behavioral baselines learned during clean trust windows; and (4) a taxonomy of nine TrustShift variants spanning three execution mechanisms (structural violation, semantic corruption, scope expansion) and three adversarial objectives (disruption, exfiltration, and their combination). Across frontier proprietary and open-weight models, TrustShift attacks achieve a 69.5% mean attack success rate that SHIELD mitigates to 42.7%.
Mehrdad Rostamzadeh, Sidhant Narula, Mohammad Ghasemigol et al.· 0 citations
A four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers is contributed, and seven open problems centered on containment are identified.
Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari· 0 citations
This paper formalizes the structure of prompt-injection artifacts, enabling defenders, red teamers, and cyber threat intelligence (CTI) teams to label, compare, and mutate attacks without relying on fragile string matching.
Jeremy McHugh· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
