Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

Source

arXiv

arxiv.org/abs/2606.27027v1

Read the source

Source

Plain-Language Brief

The paper introduces ShareLock, a stealthy multi-tool threshold poisoning framework designed to exploit the interaction between Large Language Models (LLMs) and external tools through the Model Context Protocol (MCP). ShareLock distributes malicious instructions across multiple tool descriptions using Shamir's threshold scheme. This method ensures exceptional stealth and fault tolerance, allowing the aggregated shares to reconstruct the hidden instruction during server update, resulting in critical breaches of system assets or private data. Experiments show that ShareLock outperforms existing single-tool poisoning strategies in tool description-based detection with an average attack success rate exceeding 90%.

What the Document Says

  • ShareLock is a multi-tool threshold poisoning framework
  • Based on Shamir's threshold scheme
  • Designed to exploit LLM-server interactions through MCP
  • Distributes malicious instructions as secret shares across multiple tool descriptions
  • Ensures stealth and fault tolerance
  • Reconstructs hidden instruction during server update
  • Results in critical breaches of system assets or private data
  • Evaluated through extensive experiments on mainstream LLMs across two MCP clients
  • Outperforms existing single-tool poisoning strategies in tool description-based detection with an average attack success rate exceeding 90%

Key Concepts Mentioned

  • ShareLock
  • Threshold Poisoning Framework
  • Shamir's Threshold Scheme
  • Model Context Protocol (MCP)
  • Large Language Models (LLMs)
  • Tool Poisoning Attack (TPA)
  • Stealth
  • Fault Tolerance
  • Server Update
  • System Assets
  • Private Data
  • Experiments

Claims Made by the Document

  • ShareLock is a stealthy multi-tool threshold poisoning framework
  • ShareLock outperforms existing single-tool poisoning strategies in tool description-based detection

Evidence Used

  • The paper's text provides details about the ShareLock framework and its evaluation results.

Methods / Approach

  • Use of Shamir's threshold scheme
  • Distribution of malicious instructions as secret shares across multiple tool descriptions
  • Reconstruction of hidden instruction during server update

Limitations Stated by the Authors

The paper does not discuss any potential countermeasures or defenses against ShareLock.

Limitations Noted by the Agent

Agent interpretation — not from the source.

The paper does not provide information on the impact of ShareLock in real-world scenarios, and it is unknown if the experiments were conducted in a controlled or simulated environment.

Open Questions

  • What countermeasures or defenses can be implemented to prevent ShareLock attacks?
  • In what ways does ShareLock affect real-world systems?

Notes for Future Q&A

May include interpretation. Labeled where it does.

The paper does not provide information on the specific LLMs or MCP clients used in the experiments.

Raw Abstract / Excerpt

With the rapid evolution of LLM-driven agents, Model Context Protocol (MCP), an open protocol bridging LLMs with external tools, has quickly become foundational to modern agent ecosystems. However, the expanding adoption of MCP has also introduced novel security concerns such as Tool Poisoning Attack (TPA), which exploit LLM-server interactions to inject malicious prompts. Existing poisoning schemes typically adopt a monolithic plaintext embedding paradigm, which fails to withstand manual inspection or automated detectors. Current research still lacks a systematic analysis on multi-tool poisoning, where multiple tools can be exploited cooperatively to disperse detection risk. In this paper, we introduce ShareLock, a multi-tool threshold poisoning framework that utilizes Shamir's threshold scheme to ensure exceptional stealth and fault tolerance. ShareLock distributes the malicious instruction as benign-looking secret shares across multiple tool descriptions, achieving both information-theoretic secrecy and attack robustness against moderate auditing. After a covert reconstruction trigger is planted during server update, the aggregated shares reconstruct the hidden instruction, resulting in critical breaches of system assets or private data. To evaluate the realistic threat of ShareLock, we constructed a comprehensive benchmark encompassing four multi-tool scenarios and conducted extensive experiments across mainstream LLMs on two distinct MCP clients. Our results demonstrate that ShareLock significantly outperforms existing single-tool poisoning strategies in tool description-based detection while maintaining an average attack success rate exceeding 90%.