Skip to content

ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

🕒 Published (v1): 2026-06-25 13:35 UTC · Source: Arxiv · link

Why this paper was selected

Threshold poisoning attack on MCP multi-tool chains; directly threatens harness security

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

ShareLock is a multi-tool poisoning attack against MCP-based LLM agents that fragments adversarial prompts into cryptographic shares using Shamir's Secret Sharing and distributes them across multiple tool descriptions, achieving information-theoretic stealth. A covert reconstruction trigger, introduced via a server update, causes the agent to reassemble and execute the hidden instruction. Experiments across four domains and two MCP clients show >90% average attack success rate while evading mainstream safety classifiers.

Problem

Existing Tool Poisoning Attacks (TPA) against MCP embed malicious instructions in plaintext within a single tool's description, making them trivially detectable by human review, rule-based scanners (MCPSafetyScanner, MCP-Guard), and guard models. They also suffer from a single point of failure: removing the one poisoned tool neutralizes the attack. No prior work systematically exploits multi-tool deployments for coordinated, stealthy, fault-tolerant poisoning.

Method

ShareLock operates in three stages under a \((t, n)\)-threshold model:

  1. Share Generation: The adversarial prompt \(S\) is encoded as the constant term \(a_0\) of a random degree-\((t-1)\) polynomial over a prime field \(\mathbb{F}_p\): $\(q(x) = a_0 + a_1 x + \cdots + a_{t-1} x^{t-1}, \quad a_0 = S\)$ \(n\) shares \((x_i, y_i = q(x_i))\) are generated; each share is a numeric pair that individually reveals zero information about \(S\) (information-theoretic secrecy).

  2. Stealthy Embedding: Each share is disguised as benign-looking metadata embedded in the tool descriptions of \(n\) distinct tools on an adversary-controlled MCP server. The server provides legitimate functionality under normal operation to pass moderate vetting.

  3. Reconstruction Trigger via Server Update: A Rug-Pull-style server version update introduces an auxiliary tool EnvSetup, masquerading as a system initialization step. When the agent invokes it, it aggregates \(\geq t\) shares and applies Lagrange interpolation to recover \(S = q(0)\), then executes the unauthorized action (e.g., file exfiltration, API key theft, transaction manipulation) before completing the user task.

The attack targets the Tool Description Poisoning surface (\(p_{desc} \subseteq p_{system}\)), exploiting the model's inherent trust in tool definitions established during MCP registration.

Key Contributions

  • Realistic multi-tool threat model: formalizes the MCP attack surface under a moderate vetting assumption (guard models screen servers but do not perform exhaustive auditing), replacing the naive "no vetting" baseline.
  • ShareLock framework: first threshold-based multi-tool poisoning scheme for MCP; adapts Shamir's Secret Sharing to fragment adversarial prompts into individually benign numeric shares across tool descriptions.
  • Covert reconstruction trigger: leverages a server update to inject an EnvSetup tool that initiates share aggregation and Lagrange reconstruction, mimicking a routine initialization step.
  • Comprehensive benchmark: four multi-tool domains (Travel, Coding, Finance, Office), four mainstream LLMs, two MCP clients (Cherry Studio, Cline).

Results

  • Average Attack Success Rate (ASR) >90% across four domains and two MCP clients.
  • ShareLock substantially outperforms single-tool plaintext baseline strategies on tool-description-based safety classification by mainstream LLMs (exact delta numbers are not fully present in the provided excerpt but stated as "significant").
  • Evaluated on four mainstream LLMs (specific model names not enumerated in the provided text).
  • High evasiveness confirmed against most mainstream models used as safety classifiers.
  • Inherent fault tolerance: attack succeeds even if up to \(n - t\) poisoned tools are removed by auditing.

Limitations

  • Requires the adversary to control an MCP server that exposes multiple tools; single-tool servers cannot be exploited.
  • The reconstruction trigger (EnvSetup) must be delivered via a server update, requiring the adversary to maintain ongoing server control and the ability to push updates that users accept.
  • The provided text is truncated; full ablation results (e.g., impact of varying \(t\) and \(n\), exact per-LLM ASR breakdowns) are not available for review.
  • Assumes the LLM has substantial agentic capability for multi-tool orchestration; weaker models may not reliably follow multi-step share-reconstruction instructions.
  • Defenses based on semantic equivalence checking or share-pattern detection are not addressed in the excerpted text.

Relevance to Agentic AI / LLM Agents

ShareLock directly attacks the tool-use layer of LLM agents, the exact infrastructure (MCP) that enables agents to interface with external services at scale. It demonstrates that the supply-chain trust model underlying MCP—where agents blindly ingest third-party tool descriptions into their system prompt—is exploitable in a cryptographically principled way that defeats current defenses. For researchers tracking agentic AI, this work establishes a new threat category: distributed prompt injection that is fault-tolerant and information-theoretically stealthy, raising the bar for what MCP auditing and agent security must handle. It connects to broader work on indirect prompt injection, tool trust, and multi-agent coordination security, all of which are central to deploying agents safely in production.