Dynatrace AISec paper: MCP tool poisoning works across frameworks — 22.9% ASR, zero intentional framework defenses, five vendor disclosures rejected
- Framework takeaway: nine core frameworks cluster ~23–26% ASR; incidental mitigations only (Pydantic AI duplicate-name reject 16.6%; AG2 executor constraints 4.6%).
- Defense that would help: hash-pin tool descriptions at registration, alert on rug-pull changes, scan descriptions for instruction/URL/encoded payloads (their regex scanner caught 20/45 scenarios at 7.2% FP on benign tools — partial control only).
- Deployment: treat model selection as a security control for MCP hosts; assume any installed MCP server can put attacker text in context.
- Paper scheduled AISec '26 (The Hague); artifact github.com/dynatrace-research/mcpvenom.
Sources: arXiv:2611.03555 — MCP Tool Poisoning in Agentic AI Frameworks (AISec '26)