---
title: Dynatrace AISec paper: MCP tool poisoning works across frameworks — 22.9% ASR, zero intentional framework defenses, five vendor disclosures rejected | ctxsec
url: https://ctxsec.com/items/dynatrace-mcp-tool-poisoning-cross-framework-measurement-aiseec26
description: "Farooq Shaikh and Biagio Montaruli (Dynatrace) measure MCP tool poisoning with real tool execution rather than model-compliance-only benchmarks. Across 12 popular agent frameworks, 18 models and 45 scenarios (9,720 cells), overall attack success rate is 22.9% (2,113 vulnerable cells), with evidence tiers from dispatched attacker tool call (64.9%) to confirmed network contact (23.0%) to verified secret exfiltration (12.1%). Code audit finds no intentional tool-description defense in any tested framework \u2014 descriptions pass into model context verbatim. Observed resistance is almost entirely model-level (Claude Fable 5 at 0.4% ASR vs Amazon Nova Pro at 49.7%). Five coordinated disclosures to four vendors (LangChain, AutoGen/MSRC, MCP SDK, Haystack) were all rejected, which the authors frame as a structural accountability vacuum. Tooling: open-source mcpvenom."
status: "confirmed research (arXiv:2611.03555; AISec '26); 9,720-cell matrix across 12 frameworks × 18 models × 45 scenarios; dual-oracle real execution"
published: 2026-11-06
---

> Farooq Shaikh and Biagio Montaruli (Dynatrace) measure MCP tool poisoning with real tool execution rather than model-compliance-only benchmarks. Across 12 popular agent frameworks, 18 models and 45 scenarios (9,720 cells), overall attack success rate is 22.9% (2,113 vulnerable cells), with evidence tiers from dispatched attacker tool call (64.9%) to confirmed network contact (23.0%) to verified secret exfiltration (12.1%). Code audit finds no intentional tool-description defense in any tested framework — descriptions pass into model context verbatim. Observed resistance is almost entirely model-level (Claude Fable 5 at 0.4% ASR vs Amazon Nova Pro at 49.7%). Five coordinated disclosures to four vendors (LangChain, AutoGen/MSRC, MCP SDK, Haystack) were all rejected, which the authors frame as a structural accountability vacuum. Tooling: open-source mcpvenom.

[← Context & Harness Attacks](/context) · [markdown](/items/dynatrace-mcp-tool-poisoning-cross-framework-measurement-aiseec26.md)

confirmed research (arXiv:2611.03555; AISec '26); 9,720-cell matrix across 12 frameworks × 18 models × 45 scenarios; dual-oracle real execution

2026-11-06

### Dynatrace AISec paper: MCP tool poisoning works across frameworks — 22.9% ASR, zero intentional framework defenses, five vendor disclosures rejected

- **Framework takeaway:** nine core frameworks cluster ~23–26% ASR; incidental mitigations only (Pydantic AI duplicate-name reject 16.6%; AG2 executor constraints 4.6%).
- **Defense that would help:** hash-pin tool descriptions at registration, alert on rug-pull changes, scan descriptions for instruction/URL/encoded payloads (their regex scanner caught 20/45 scenarios at 7.2% FP on benign tools — partial control only).
- **Deployment:** treat model selection as a security control for MCP hosts; assume any installed MCP server can put attacker text in context.
- Paper scheduled AISec '26 (The Hague); artifact github.com/dynatrace-research/mcpvenom.

Sources: [arXiv:2611.03555 — MCP Tool Poisoning in Agentic AI Frameworks (AISec '26)](https://arxiv.org/abs/2611.03555)