LATIDIA · Ciberseguridad

Medición y explotación de la confianza implícita en las líneas de llamadas de herramientas de LLM

arXiv: 2609.18217v1Tipo de Anuncio: nuevo Resumen: El Protocolo de Contexto de Modelo (MCP) permite a los LLM invocar herramientas externas, pero cada interacción de herramienta expone el modelo al texto controlado por el atacante a través de múltiples canales de entrada

La noticia

arXiv:2609.18217v1 Announce Type: new Abstract: The Model Context Protocol (MCP) enables LLMs to invoke external tools, but every tool interaction exposes the model to attacker-controlled text through multiple input channels (tool descriptions, tool results, sampling messages) that share a single context window without privilege separation. In this paper, we present a framework to measure the trust profile of an arbitrary LLM based on a variety of payload framings sent through different channels. Following this assessment, we devise cross-channel fragmentation attacks that distribute seemingly benign payloads across two or three channels; no individual channel carries a complete injection, yet the LLM compiles the fragments into credential exfiltration. We evaluated our attacks