Hijacking of AI agents via the MCP protocol: A2M framework reveals fragility of semantic supply chains

Modern AI agent systems increasingly rely on the Model Context Protocol, abbreviated as MCP, to connect models to external tools and third-party data sources. However, this architectural pattern, which relies on semantic matching to select the appropriate tool, opens a deep security gap in supply chains, according to a research paper accepted at the 2026 AACL-IJCNLP conference titled A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem. The authors explain that agents’ reliance on abstract textual descriptions to choose tools allows attackers to exploit metadata and execution outputs to seize control of the agent’s behavior and divert it from its intended path.

The research team presented a black-box attack framework they named A2M, short for the transition path from attraction to manipulation, which operates through two consecutive stages that do not require access to the models’ internal weights.The first attraction stage relies on enhancing the malicious tool’s metadata to raise the likelihood of its invocation to the highest possible level.During the agent’s processing of user queries, it exploits the semantic ranking mechanism. This is followed by the manipulation stage, in which the attacker leverages successive execution traces to precisely reset and refine the hostile tool’s outputs, steering the agent’s subsequent decisions and actions toward the outcomes desired by the attacker.

Practical tests conducted on the standard evaluation platform LiveMCPBench revealed dangerously high levels of operational effectiveness. When the direct attack was applied and tuned to the GLM-4.6 model, the framework achieved an average malicious-tool invocation rate of 93.6 % across four different scenarios. The attack also caused what is termed cognitive denial-of-service, with weighted token consumption costs jumping to 32.4 times the normal baseline for clean operation, representing a massive drain on compute resources. Overall, the framework recorded a success rate of 74.4 % in achieving its malicious goals, which included information leakage, compromising operational safety, and diverting the model’s reasoning trajectory.

The technique’s risk did not stop at the directly targeted model but extended across comprehensive transfer tests.When the attack outputs were applied to four other AI models with no prior modification or fine-tuning, the malicious tool maintained an average invocation rate of 63.6 % and increased token costs by 2.7 times in the denial-of-service scenario, while achieving an attack success rate of 24.5 %. These results demonstrate that the fragility of semantic matching is not a flaw specific to a particular model architecture but an inherent weakness in how agents interact with open-tool environments.

This revelation has practical and immediate implications for engineering teams and tech companies in the Gulf, Egypt, and the Levant, especially given the rising reliance on software agents to automate enterprise tasks and connect internal databases to cloud services via MCP. The risk of cognitive denial-of-service means that organizations paying for API usage based on consumption are threatened with draining their operational budgets due to repeated long inference cycles fed by manipulated tools. Moreover, superficial inspection of metadata is no longer sufficient, requiring regional technology leaders to shift toward programmatic isolation of runtime environments and to mandate strict, comprehensive vetting of every third-party tool before granting it access to enterprise agents.

The researchers who made the project’s code publicly available concluded that securing the MCP ecosystem requires a radical overhaul of semantic trust mechanisms and the imposition of stringent monitoring of outputs during live execution. Agent protection goes beyond model accuracy to maintaining security barriers around every tool they interact with.