Hijacking AI Agents Through Tool Semantics: The A2M Attack Framework
The Model Context Protocol (MCP) has rapidly become the standard interface connecting AI agents to external tools and data sources. Rather than building every capability from scratch, agents can dynamically select and invoke tools from third-party registries, dramatically expanding their functional scope. But this architectural convenience introduces a vulnerability that researchers have only begun to quantify: the semantic layer through which tools are selected and their outputs consumed can be systematically exploited to hijack agent behavior.
A2M (Attraction-to-Manipulation), introduced by Laizhen Li and colleagues at the Shenzhen Institutes of Advanced Technology, the Chinese Academy of Sciences, and other institutions, is a two-stage black-box framework that exploits this vulnerability to hijack MCP-based agents. On the LiveMCPBench benchmark, direct attacks optimized and evaluated on GLM-4.6 achieve a malicious tool invocation rate of 93.6% across four attack scenarios, inflate token costs to 32.4 times the benign baseline under Cognitive Denial of Service, and attain a mean attack success rate of 74.4% across information exfiltration, environment integrity compromise, and reasoning derailment.
The Semantic Supply-Chain Problem
To understand why A2M works, consider how an MCP agent selects tools. When an agent faces a task, it queries a registry of available tools and selects among them based on semantic matching of tool names and descriptions against the task requirements. This semantic dependency is the attack surface. An attacker who controls a tool's metadata can craft descriptions that appear ostensibly benign while being optimized to be preferentially selected by the agent's semantic matcher.
The vulnerability goes deeper than selection. Once a tool is invoked, its return content is treated by the agent as trusted environment feedback rather than untrusted textual input. An attacker who controls the tool's execution endpoint can embed control information disguised as system states or execution results into tool responses, hijacking the agent's subsequent reasoning, tool usage, and actions. This is a fundamentally different threat from direct prompt injection or jailbreaking, where the attacker manipulates the user-to-agent interface. In the MCP setting, both the user and the agent may behave benignly, while the attack occurs entirely through the tool integration layer.
The researchers frame this as a semantic supply-chain risk, analogous to supply-chain attacks in traditional software but operating through the trusted interfaces that agents use to interact with their environment. The attack does not require compromising the model itself, only the tools the model autonomously selects and invokes.
The Two-Stage Attack Architecture
A2M decomposes the attack into two coupled but optimizable stages, each targeting a different phase of the agent's interaction with the tool ecosystem.
Phase I, Attraction, optimizes the tool's metadata to maximize the probability that the agent selects and invokes the malicious tool among competing benign alternatives. The framework employs five persuasion strategies: Authority (framing the tool as authoritative or official), Urgency (emphasizing time-sensitive or critical functionality), Comprehensiveness (making the tool appear to cover a broad range of capabilities), Resource Optimality (suggesting the tool is the most efficient choice), and Security (implying the tool provides enhanced safety or protection). For each strategy, a generator LLM samples candidate tool names and descriptions. Each candidate is evaluated through Monte Carlo rollouts measuring the selection rate, with candidates achieving non-zero selection rates retained as elite seeds.
Phase II, Manipulation, generates adversarial tool return payloads that steer the agent toward attacker-specified outcomes after the tool has been invoked. The framework uses an Analyzer-Optimizer architecture to make this black-box search tractable. The Analyzer examines execution traces to diagnose why an attack failed, identifying whether the failure was due to semantic ambiguity, safety refusal, or the agent ignoring the adversarial payload. The Optimizer then uses this diagnostic feedback to refine the payload through targeted edits rather than random search.
The key insight enabling this architecture is that the two objectives are coupled during execution but decoupled for optimization. An effective payload has no impact if the tool is never selected, while a frequently selected tool may still fail if its return content is ignored or refused. By optimizing each stage sequentially and using execution-trace feedback to guide refinement, A2M avoids the combinatorial explosion that a joint optimization would entail.
Four Attack Scenarios and How They Work
A2M targets four distinct attack objectives, each representing a different class of real-world harm that an adversarial tool could enable.
In Cognitive Denial of Service (C-DoS), the attacker constructs tool definitions that entrap the agent in redundant reasoning loops or recursive tool invocations, resulting in significant token consumption inflation. The fitness function measures weighted token costs, with output tokens weighted five times higher than input tokens to reflect real-world pricing structures where generation costs roughly five times more than input processing.
In Information Exfiltration (IE), the attacker manipulates the agent into retrieving sensitive data from memory or the local file system and sending it as arguments to the attacker-controlled malicious tool endpoint. The agent, trusting the tool as part of its environment, voluntarily discloses private information.
In Environment Integrity Compromise (EIC), the attacker compels the agent to execute unauthorized write operations, such as altering configuration files or installing persistent backdoors, compromising the host environment's integrity. Because the agent operates in a real execution environment with file system and tool access, these actions have real consequences.
In Reasoning Derailment (RD), the attacker disrupts the logical flow of agent reasoning via the adversarial payload, causing the selection of incorrect downstream tools or premature session termination. This is particularly insidious because the agent's reasoning appears normal on the surface while systematically deviating from the intended task.
Results: The Scale of the Vulnerability
Evaluated on LiveMCPBench, which contains 95 real-world tasks across six domains and 70 MCP servers exposing 527 tools, A2M demonstrates the severity of the semantic supply-chain vulnerability across five frontier models.
When directly optimized and evaluated on GLM-4.6, A2M achieves a mean malicious tool invocation rate of 93.6% across four attack scenarios. Under C-DoS, weighted token costs inflate to 32.4 times the benign baseline. Across IE, EIC, and RD, the mean attack success rate reaches 74.4%. These numbers indicate that a sufficiently motivated attacker can reliably hijack agent behavior through tool metadata and return payload optimization alone.
The cross-model transfer results reveal both the breadth and the limits of the attack. When A2M's optimized tools, generated on GLM-4.6, are transferred to four other models without re-optimization, the mean malicious tool invocation rate drops to 63.6% and the mean attack success rate drops to 24.5%, while C-DoS cost inflation averages 2.7 times. Tool invocation transfers more consistently than full attack success, suggesting that semantic matching for tool selection is more model-invariant than the downstream reasoning that determines whether an attack succeeds.
A critical finding is that high tool invocation does not necessarily imply attack success. On GPT-5, A2M achieves malicious tool invocation rates between 64.9% and 76.3% across scenarios, yet the attack success rate remains 0% for IE and EIC and only 22.0% for RD. The most common failure mode is that agents ignore the adversarial payload despite invoking the malicious tool. This suggests that while the semantic selection layer is highly exploitable, the reasoning layer provides some residual resistance, though far from immunity.
Ablation: What Makes the Attack Effective
The ablation study on GLM-4.6 isolates the contribution of each design choice. The full A2M pipeline achieves a mean C-DoS cost multiplier of 28.86x. Removing the two-stage generation pipeline drops this to 10.70x, removing the curated initial persuasion strategies drops it to 13.29x, and removing trajectory optimization drops it to 10.65x. All three components are essential to the attack's efficiency.
Among the persuasion strategies, Comprehensiveness and Resource Optimality account for 31.6% and 22.1% of selected metadata respectively, suggesting that tools appearing broadly capable and resource-efficient are most attractive to agents. This provides a practical defense insight: agents should be particularly skeptical of tools whose descriptions emphasize breadth of capability or optimality claims.
Defenses and Limitations
The paper evaluates several defense mechanisms including metadata paraphrasing and runtime information-flow controls. The defense evaluations reveal limitations in attack detection and show that even these countermeasures leave residual risk in the evaluated settings. This is an important finding: there is no simple fix for the semantic supply-chain vulnerability because the attack exploits the fundamental architecture of how agents select and trust tools.
The study has several limitations. It targets semantic-layer attacks in MCP tool selection and return handling, assuming the adversary can register a malicious tool. It does not cover lower-level network or OS exploits, nor long-horizon tasks where delayed effects might surface. The Analyzer-Optimizer loop depends on execution traces; environments with limited trace visibility or aggressive rate limiting may reduce optimization efficiency. Results are based on LiveMCPBench and a fixed ReAct-style MCP agent stack.
What This Means in Practice
A2M exposes a fundamental tension in the agentic AI ecosystem. The MCP architecture's power comes from its flexibility: agents can dynamically discover and invoke tools from a diverse ecosystem of third-party providers. But this same flexibility creates a supply-chain vulnerability where any tool in the ecosystem can become a vector for hijacking agent behavior.
For practitioners deploying MCP-based agents, the implications are clear. Tool vetting must go beyond functional correctness to include semantic security analysis, and runtime isolation mechanisms are needed to prevent adversarial tool outputs from steering agent reasoning unchecked. The paper's code, available at https://github.com/Lilaizhen/A2M, provides a practical framework for evaluating the security posture of MCP tool ecosystems.
For the broader AI safety community, A2M introduces a new threat category that existing security paradigms were not designed to address. The attack operates not through the user interface or the model itself, but through the trusted interfaces between the model and its tools. As MCP and similar protocols become the standard architecture for agentic systems, addressing the semantic supply-chain risk will be essential to building agents that can safely operate in open, unverified tool ecosystems.
The Bottom Line
A2M demonstrates that the semantic layer through which AI agents select and consume tools is a potent and largely unexploited attack surface. By systematically optimizing tool metadata to attract agent selection and then refining adversarial return payloads to manipulate downstream reasoning, the framework achieves attack success rates of 74.4% against five frontier models. The key finding, that tool invocation transfers more consistently across models than attack success, reveals both the breadth of the vulnerability and the partial protection offered by model-specific reasoning defenses. As MCP-based agent systems move toward production deployment, the security community needs to treat the tool integration layer as a first-class attack surface and build stronger vetting and runtime isolation mechanisms before the vulnerabilities A2M exposes are exploited in the wild.