Malicious Tool Metadata Pulled Agents Off Course

A2M targets agents that choose Model Context Protocol tools through semantic matching. Its attraction stage rewrites attacker-controlled metadata to raise invocation probability; its manipulation stage refines tool returns from execution traces. On LiveMCPBench, attacks optimized for one model reached a 93.6% macro-average malicious invocation rate across four scenarios, while cross-model transfer was lower. These are benchmark results under a constructed threat model, but they support stronger tool vetting and runtime isolation.