THE QUANTUM INTELLIGENCER

A preprint posted to the arXiv this month describes a method by which an agent using the Model Context Protocol may be steered toward outcomes its operator never intended. The authors call the method A2M, for Attraction-to-Manipulation, and it exploits a property of the protocol that is ordinarily a convenience: agents select tools from third-party servers by semantic matching, and an attacker who controls a tool's metadata and outputs can therefore shape both the selection and the consequence. In the first stage, the Attraction phase, tool metadata is optimised to increase the probability of invocation; in the second, the Manipulation phase, execution traces are used to refine the returns that steer the agent. On LiveMCPBench, a public benchmark, attacks optimised and evaluated on the GLM-4.6 model invoked the malicious tool at a macro-average rate of 93.6 per cent across four scenarios; under a Cognitive Denial of Service the weighted token cost reached 32.4 times the benign baseline; and the mean attack success rate stood at 74.4 per cent across Information Exfiltration, Environment Integrity Compromise and Reasoning Derailment. Transferred to four other models without re-optimisation, the corresponding figures fell to 63.6 per cent, 2.7 times, and 24.5 per cent. The authors argue for stronger tool vetting and runtime isolation in MCP ecosystems. None of this establishes that any deployed system has been compromised; the work is a preprint, and its evidence is a controlled benchmark. It establishes, rather, that the mechanism is real, and that the numbers are large enough to warrant careful cataloguing. Let the scope be stated plainly. The demonstration occupies a single laboratory bench: one protocol surface, one public benchmark, four scenarios. It shows that a black-box attacker who controls tool metadata and outputs can, under those conditions, steer an agent whose selection relies on semantic matching. That is a real result, and it is a narrow one. It is not a census of the model context protocol's ecosystem, nor a measure of every agent that speaks the protocol. The authors themselves mark the boundary by carrying the attack to four other models without re-optimisation, and the fall in the figures is the shape of that boundary. The mechanism is confirmed at the bench; how far it reaches in the field remains an open question. —Ada H. Pemberley Dispatch from The Prepared E0