{"id":"https://openalex.org/W7138189915","doi":"https://doi.org/10.1609/aaai.v40i42.40895","title":"MCPTox: A Benchmark for Tool Poisoning on Real-World MCP Servers","display_name":"MCPTox: A Benchmark for Tool Poisoning on Real-World MCP Servers","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7138189915","doi":"https://doi.org/10.1609/aaai.v40i42.40895"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v40i42.40895","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i42.40895","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1609/aaai.v40i42.40895","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129659861","display_name":"Zhiqiang Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhiqiang Wang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129692040","display_name":"Yichao Gao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yichao Gao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129739500","display_name":"Yanting Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yanting Wang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008776805","display_name":"Suyuan Liu","orcid":"https://orcid.org/0000-0003-0018-0366"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Suyuan Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129666462","display_name":"Haifeng Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haifeng Sun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102801538","display_name":"Haoran Cheng","orcid":"https://orcid.org/0009-0000-3950-2700"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haoran Cheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124925001","display_name":"Guanquan Shi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guanquan Shi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129752183","display_name":"Haohua Du","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haohua Du","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5129681268","display_name":"Xiangyang Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiangyang Li","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":21.5228,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.99150543,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"40","issue":"42","first_page":"35811","last_page":"35819"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.36800000071525574,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.36800000071525574,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.11389999836683273,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.08060000091791153,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6870999932289124},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6413000226020813},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.6403999924659729},{"id":"https://openalex.org/keywords/safer","display_name":"SAFER","score":0.59579998254776},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5679000020027161},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5382999777793884},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.5289999842643738},{"id":"https://openalex.org/keywords/suite","display_name":"Suite","score":0.4627000093460083},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.4172999858856201}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6948000192642212},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6870999932289124},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6413000226020813},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.6403999924659729},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6313999891281128},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.59579998254776},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5679000020027161},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5382999777793884},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5289999842643738},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.4627000093460083},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4172999858856201},{"id":"https://openalex.org/C152124472","wikidata":"https://www.wikidata.org/wiki/Q1204361","display_name":"Redundancy (engineering)","level":2,"score":0.3928999900817871},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.3727000057697296},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.35100001096725464},{"id":"https://openalex.org/C151552104","wikidata":"https://www.wikidata.org/wiki/Q7705809","display_name":"Test suite","level":4,"score":0.3328000009059906},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.31690001487731934},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3131999969482422},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.30000001192092896},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.2948000133037567},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.29170000553131104},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.2858000099658966},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.28349998593330383},{"id":"https://openalex.org/C20136886","wikidata":"https://www.wikidata.org/wiki/Q749647","display_name":"Interoperability","level":2,"score":0.2770000100135803},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.27379998564720154},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.27250000834465027},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2662000060081482},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.2531999945640564}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1609/aaai.v40i42.40895","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i42.40895","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},{"id":"pmh:oai:ojs.aaai.org:article/40895","is_oa":false,"landing_page_url":"https://ojs.aaai.org/index.php/AAAI/article/view/40895","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2159-5399","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v40i42.40895","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i42.40895","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4423233787","display_name":null,"funder_award_id":"2021ZD0302900","funder_id":"https://openalex.org/F4320329860","funder_display_name":"National Science and Technology Major Project"}],"funders":[{"id":"https://openalex.org/F4320329860","display_name":"National Science and Technology Major Project","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"By":[0],"providing":[1],"a":[2,21,54,66,85,131,157,231],"standardized":[3],"interface":[4],"for":[5,225,235,246],"LLM":[6,153],"agents":[7,154,197],"to":[8,36,95,129,160],"interact":[9],"with":[10,163,202],"external":[11,38,49],"tools,":[12],"the":[13,24,70,92,183,191,203,247],"Model":[14],"Context":[15],"Protocol":[16],"(MCP)":[17],"is":[18,108,216],"quickly":[19],"becoming":[20],"cornerstone":[22],"of":[23,134,145,170,249],"modern":[25],"autonomous":[26],"agent":[27,98],"ecosystem.":[28],"However,":[29],"it":[30],"creates":[31],"novel":[32],"attack":[33,127,167,184],"surfaces":[34],"due":[35],"untrusted":[37],"tools.":[39,119],"While":[40],"prior":[41],"work":[42],"has":[43,77],"focused":[44],"on":[45,150],"attacks":[46],"injected":[47],"through":[48,81],"tool":[50],"outputs,":[51],"we":[52,123,243],"investigate":[53],"more":[55,175,180],"fundamental":[56],"vulnerability:":[57],"Tool":[58,101,161],"Poisoning,":[59,162],"where":[60],"malicious":[61,136,219],"instructions":[62],"are":[63,178],"embedded":[64],"within":[65],"tool's":[67],"metadata":[68],"at":[69],"registration":[71],"stage.":[72],"To":[73,120],"date,":[74],"this":[75,239],"threat":[76],"been":[78],"primarily":[79],"demonstrated":[80],"isolated":[82],"cases,":[83],"lacking":[84],"systematic,":[86],"large-scale":[87],"evaluation.":[88],"We":[89,172],"introduce":[90],"MCPTox,":[91],"first":[93],"benchmark":[94],"systematically":[96],"evaluate":[97],"robustness":[99],"against":[100,218],"Poisoning":[102],"in":[103],"realistic":[104],"MCP":[105,114],"settings.":[106],"MCPTox":[107,245],"constructed":[109],"upon":[110],"45":[111],"live,":[112],"real-world":[113],"servers":[115],"and":[116,237,242],"353":[117],"authentic":[118],"achieve":[121],"this,":[122],"design":[124],"three":[125],"distinct":[126],"templates":[128],"generate":[130],"comprehensive":[132],"suite":[133],"1348":[135],"test":[137],"cases":[138],"by":[139],"few-shot":[140],"learning,":[141],"covering":[142],"10":[143],"categories":[144],"potential":[146],"risks.":[147],"Our":[148,228],"evaluation":[149],"20":[151],"prominent":[152],"setting":[155],"reveals":[156,195],"widespread":[158,240],"vulnerability":[159],"GPT-o1-mini,":[164],"achieving":[165],"an":[166],"success":[168],"rate":[169,206],"72.8%.":[171],"find":[173],"that":[174,196,212,221],"capable":[176],"models":[177],"often":[179],"susceptible,":[181],"as":[182],"exploits":[185],"their":[186],"superior":[187],"instruction-following":[188],"abilities.":[189],"Finally,":[190],"failure":[192],"case":[193],"analysis":[194],"rarely":[198],"refuse":[199],"these":[200],"attacks,":[201],"highest":[204],"refused":[205],"(Claude-3.7-Sonnet)":[207],"less":[208],"than":[209],"3%,":[210],"demonstrating":[211],"existing":[213],"safety":[214],"alignment":[215],"ineffective":[217],"actions":[220],"use":[222],"legitimate":[223],"tools":[224],"unauthorized":[226],"operation.":[227],"findings":[229],"create":[230],"crucial":[232],"empirical":[233],"baseline":[234],"understanding":[236],"mitigating":[238],"threat,":[241],"release":[244],"development":[248],"verifiably":[250],"safer":[251],"AI":[252],"agents.":[253]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-07-02T09:51:11.867554","created_date":"2026-03-18T00:00:00"}