ai-research-survey

scan.json (24336B)

---

 {
   "paper": {
     "title": "MSB (MCP Security Bench): Benchmarking Attacks Against Model Context Protocol in LLM Agents",
     "authors": ["Dongsen Zhang", "Zekun Li", "Xu Luo", "Xuannan Liu", "Peipei Li", "Wenjun Xu"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2510.15994"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "MSB evaluates 9 LLM agents across 12 MCP-specific attack types with 2,000 attack instances, finding an overall average ASR of 40.71%. Out-of-scope parameter attacks are most effective (74.03% ASR). An inverse scaling law is observed: more capable models are more vulnerable due to stronger tool-use and instruction-following abilities. MCP-specific attacks (user impersonation, false error) are more aggressive than traditional function-calling attacks (prompt injection, retrieval injection).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, GitHub link, or code archive is provided in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "No dataset download link or repository for the 2,000 attack instances is provided. The benchmark is described but not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment setup details are provided beyond naming the LLM models used."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, scripts, or README are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables 3, 8, and 9 report only point estimates for ASR, PUA, and NRP with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes comparative claims about model vulnerability (e.g., 'more capable models are more susceptible') but uses no statistical tests—just raw ASR comparisons."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "ASR percentages are reported with baseline context (e.g., 'peak attack success rate of 75.83%', per-attack and per-model breakdowns in Table 3), providing magnitude of effects."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The benchmark includes 2,000 attack instances and 65 user tasks but no justification for why these numbers are sufficient or any power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or multi-run results are reported. It appears each attack instance was run once per model."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Nine LLM backbones are compared against each other across all attack types, and the paper compares MSB's scope against prior benchmarks (ASB, AgentDojo, InjecAgent, MCPTox) in Table 1 of related work."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Models evaluated include DeepSeek-V3.1, Claude 4 Sonnet, Gemini 2.5 Flash, GPT-4o-mini, Qwen3, and Llama 3.3—all recent models."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates individual attack types and mixed attacks separately, showing which attack vectors and stages contribute most to ASR (Fig. 3 shows per-stage and per-tool-configuration breakdowns)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are used: ASR, PUA, and NRP (Sec. 5.2), capturing attack effectiveness, task performance under attack, and their trade-off."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Evaluation is entirely automated—attack success is determined by examining workspace state and tool invocation logs. No human evaluation of attack quality or agent behavior."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "This is a benchmark evaluation of existing models, not a trained system. There is no train/test split to manage."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (12 types), by model (9 models), by pipeline stage (Fig. 3a), and by tool configuration (Fig. 3b)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No qualitative failure analysis or examples of why specific attacks failed against specific models. Only aggregate ASR numbers are reported."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several attacks show low effectiveness: NC-FE has only 16.25% average ASR, RI is 0% for most models, and PI is only 0% for Llama3.3 70B. These are reported transparently."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'peak attack success rate of 75.83%' and 'stronger models are more vulnerable'—both are supported by Table 3 and Fig. 2 results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 'Models with stronger performance are more vulnerable to attacks due to their outstanding tool calling and instruction following capabilities' (abstract). This causal explanation is asserted without controlled experiments isolating tool-calling ability as the causal factor."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title and abstract frame MSB as evaluating 'MCP agents' generally, but the evaluation uses a specific system prompt (Fig. 4), specific attack task templates, and specific tool configurations. These scope boundaries are not explicitly stated as limitations."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The inverse scaling finding is attributed solely to tool-calling ability. Alternative explanations (e.g., different safety training, RLHF alignment differences, system prompt sensitivity) are not discussed."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "ASR measures whether the agent performs the attack task (e.g., writes a file, kills a process), which is framed as 'security vulnerability.' The paper does not discuss whether these controlled lab attacks reflect real-world MCP security risk, or whether the specific attack tasks chosen are representative proxies for actual security harm."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed as 'DeepSeek-V3.1', 'GPT-4o-mini', 'Claude 4 Sonnet', 'Gemini 2.5 Flash', 'Qwen3 8B', etc. No API version dates, snapshot identifiers, or specific version strings (e.g., gpt-4o-mini-2024-07-18) are provided."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The system prompt template is provided in Fig. 4, and specific attack prompt templates are shown in Table 1, Tables 4-5, and detailed attack examples in Appendix B."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No temperature, top-p, max tokens, or other inference hyperparameters are reported for any of the 9 LLM evaluations."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The MCP host-client-server workflow is described in Sec. 3.1 and Fig. 1. The agent scaffold uses system prompt with tool list injection, iterative tool invocation, and observation sequence—all described formally."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C describes how benign tools were sourced from Smithery, how attack tools were constructed by modifying benign tools (C.1.2), how user tasks were designed (C.2), and how attack instances were combined (C.3)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no limitations, threats to validity, or discussion section. The paper ends with Sec. 7 Conclusion, which is a brief summary without discussing limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state what the results do NOT show, what populations are excluded, or what claims are NOT being made."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data (individual attack instance results, agent traces, tool invocation logs) is made available."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C describes how tools were sourced from Smithery, how attack tools were constructed, how tasks were designed, and how attack instances were combined. Table 2 summarizes statistics."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants; data sources are LLM APIs and MCP tool configurations."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from tool selection to attack construction to evaluation is documented in Sec. 5 and Appendix C, including how attack success is determined by examining workspace state."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Beijing University of Posts and Telecommunications and University of California, Santa Barbara."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed, so independence cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates 9 LLMs on their benchmark but does not state training data cutoff dates for any model."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the attack scenarios or tool descriptions could overlap with model training data."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The benchmark is new (so contamination risk is lower), but the paper does not discuss this or the fact that MCP documentation and similar attack patterns may be in training data."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Running 2,000 attack instances across 9 LLMs (18,000+ LLM calls) and no cost, token count, or latency information is provided."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total compute budget, API costs, or hardware specifications are mentioned."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple seeds or runs. Results appear to be single-run per attack instance per model."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of runs per attack instance is not stated. It appears each instance was run once."
       },
       "hyperparameter_search_budget": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates existing models via API without hyperparameter tuning."
       },
       "best_config_selection_justified": {
         "applies": false,
         "answer": false,
         "justification": "No configuration selection was performed; all models were evaluated with the same setup."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "No statistical tests are performed at all, so multiple comparison correction is not applied despite comparing 9 models across 12 attack types."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors designed both the benchmark and the attack tools, then evaluated models on their own benchmark. This self-evaluation bias is not acknowledged."
       },
       "compute_budget_vs_performance": {
         "applies": false,
         "answer": false,
         "justification": "Compute differences between models are not a focus; the study evaluates security rather than performance-per-compute."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether its 6 attack tasks (file writing, process killing, data exfiltration) represent the full space of real-world MCP security threats, or whether ASR on these tasks generalizes to actual security risk."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "All models use the same system prompt (Fig. 4) but it is unclear whether the MCP client/scaffold is identical across models. Different models may have different native tool-calling mechanisms that interact differently with MCP, and this confound is not discussed."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The benchmark is new but the paper does not discuss whether MCP documentation, attack patterns, or tool configurations could appear in model training data."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information (e.g., whether the system prompt or tool descriptions give hints about expected behavior)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 2,000 attack instances are combinations of 65 user tasks and 6 attack tasks, creating structural dependencies. This non-independence is not discussed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied."
       }
     }
   },
   "claims": [
     {
       "claim": "Overall average attack success rate across all models and attack types is 40.71%.",
       "evidence": "Table 3 shows per-model, per-attack ASR values averaging to 40.71% (Sec. 6.2).",
       "supported": "strong"
     },
     {
       "claim": "Out-of-scope parameter attacks are the most effective, achieving 74.03% average ASR.",
       "evidence": "Table 3 shows OP column averaging 74.03% across 9 models.",
       "supported": "strong"
     },
     {
       "claim": "An inverse scaling law exists between LLM capability and security—more capable models are more vulnerable.",
       "evidence": "Fig. 2 and Table 3 show DeepSeek-V3.1 (highest PUA) also has highest ASR (60.94%). Smaller models like Llama3.1 8B have lower ASR (19.74%). But this is correlational, not causally demonstrated.",
       "supported": "moderate"
     },
     {
       "claim": "MCP-specific attacks (UI, FE) are more aggressive than traditional function-calling attacks (PI, RI).",
       "evidence": "Table 3: UI average ASR 50.72% and FE 43.42% vs PI 17.03% and RI 18.89%.",
       "supported": "moderate"
     },
     {
       "claim": "Attacks remain effective even in multi-tool environments containing benign tools.",
       "evidence": "Fig. 3b shows significant ASR for attacks in configurations with benign tools present.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No limitations section",
       "detail": "The paper has no limitations, threats to validity, or discussion section. For a security benchmark paper proposing a new evaluation framework, this is a significant omission."
     },
     {
       "flag": "No variance or multi-run reporting",
       "detail": "LLM outputs are stochastic, yet results appear to be single-run. With no variance reporting, it's impossible to know if observed ASR differences are stable or artifacts of sampling."
     },
     {
       "flag": "No artifacts released",
       "detail": "Neither code nor benchmark data is released, making the benchmark unverifiable and non-reproducible despite being framed as a community resource."
     },
     {
       "flag": "Causal claims without causal evidence",
       "detail": "The 'inverse scaling law' claim attributes vulnerability to 'tool calling and instruction following capabilities' without controlled experiments isolating these factors from other model differences (safety training, RLHF, etc.)."
     },
     {
       "flag": "Missing hyperparameters",
       "detail": "Temperature and sampling settings are not reported for any of the 9 models, despite these significantly affecting tool-calling behavior and susceptibility to injection attacks."
     },
     {
       "flag": "Self-evaluation bias",
       "detail": "Authors designed the benchmark, attack tools, and evaluation criteria, then reported results without acknowledging or mitigating self-evaluation bias."
     }
   ],
   "cited_papers": [
     {
       "title": "Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents",
       "authors": ["Hanrong Zhang", "Jingyuan Huang", "Kai Mei"],
       "year": 2025,
       "relevance": "Prior agent security benchmark using function-calling paradigm, direct comparison point for MSB."
     },
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic"],
       "year": 2025,
       "relevance": "Dynamic benchmark for LLM agent attacks/defenses, cited as limited to function-calling paradigm."
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "relevance": "Benchmark for indirect prompt injection in tool-using agents."
     },
     {
       "title": "EnIGMA: Interactive tools substantially assist LM agents in finding security vulnerabilities",
       "authors": ["Talor Abramovich", "Meet Udeshi", "Minghao Shao"],
       "year": 2025,
       "relevance": "Evaluates LLM agents for security vulnerability discovery with interactive tools."
     },
     {
       "title": "TrustAgent: Towards Safe and Trustworthy LLM-based Agents through Agent Constitution",
       "authors": ["Wenyue Hua", "Xianjun Yang", "Zelong Li"],
       "year": 2024,
       "relevance": "Safety framework for LLM agents using constitutional principles."
     },
     {
       "title": "ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs",
       "authors": ["Yujia Qin", "Shi Liang", "Yining Ye"],
       "year": 2024,
       "relevance": "Large-scale tool-use benchmark for LLMs, foundational to tool-calling evaluation."
     },
     {
       "title": "Toolformer: Language Models Can Teach Themselves to Use Tools",
       "authors": ["Timo Schick", "Jane Dwivedi-Yu", "Roberto Dessi"],
       "year": 2023,
       "relevance": "Foundational work on LLM tool use, relevant to understanding tool-calling capabilities."
     },
     {
       "title": "Inverse Scaling: When Bigger Isn't Better",
       "authors": ["Ian R. McKenzie", "Alexander Lyzhov", "Michael Martin Pieler"],
       "year": 2023,
       "relevance": "Establishes the inverse scaling phenomenon that MSB claims to observe in security context."
     },
     {
       "title": "MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits",
       "authors": ["Brandon Radosevich", "John Halloran"],
       "year": 2025,
       "arxiv_id": "2504.03767",
       "relevance": "Early MCP security audit demonstrating retrieval injection and other MCP-specific attacks."
     },
     {
       "title": "Systematic Analysis of MCP Security",
       "authors": ["Yongjian Guo", "Puzhuo Liu", "Wanlun Ma"],
       "year": 2025,
       "arxiv_id": "2508.12538",
       "relevance": "Systematic analysis of MCP security vulnerabilities including false error attacks."
     },
     {
       "title": "Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol Ecosystem",
       "authors": ["Hao Song", "Yiming Shen", "Wenxuan Luo"],
       "year": 2025,
       "arxiv_id": "2506.02040",
       "relevance": "Identifies attack vectors in the MCP ecosystem."
     },
     {
       "title": "MPMA: Preference Manipulation Attack Against Model Context Protocol",
       "authors": ["Zihan Wang", "Hongwei Li", "Rui Zhang"],
       "year": 2025,
       "arxiv_id": "2505.11154",
       "relevance": "Preference manipulation attacks against MCP, one of the attack types evaluated in MSB."
     }
   ]
 }