ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Liwei Liu, Tianzhu Han, Zijian Liu, Zishu Dong, Na Ruan
• Venue: arXiv: cs.CR
• Published: 2026-06-25
• Collected: 2026-06-26
• URL: http://arxiv.org/abs/2606.27027v1
• PDF: https://arxiv.org/pdf/2606.27027v1
• DOI: UNKNOWN

Plain-Language Brief

Researchers introduce a new method called ShareLock, a multi-tool threshold poisoning framework that uses Shamir's threshold scheme to inject malicious instructions into LLM-servers through MCP. The method disperses the malicious instruction as secret shares across multiple tool descriptions to ensure secrecy and robustness against moderate auditing. Experiments show that ShareLock outperforms existing single-tool poisoning strategies in tool description-based detection with an average attack success rate exceeding 90%.

What the Document Says

• The paper discusses ShareLock, a multi-tool threshold poisoning framework.
• ShareLock uses Shamir's threshold scheme.
• It disperses malicious instructions as secret shares across multiple tool descriptions.
• The method aims for information-theoretic secrecy and attack robustness against moderate auditing.

Key Concepts Mentioned

• ShareLock
• Multi-tool poisoning
• Threshold poisoning
• Shamir's threshold scheme
• LLM-servers
• Model Context Protocol (MCP)
• Malicious instructions

Claims Made by the Document

• ShareLock significantly outperforms existing single-tool poisoning strategies in tool description-based detection.

Evidence Used

• Results from experiments conducted across mainstream LLMs on two distinct MCP clients

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

With the rapid evolution of LLM-driven agents, Model Context Protocol (MCP), an open protocol bridging LLMs with external tools, has quickly become foundational to modern agent ecosystems. However, the expanding adoption of MCP has also introduced novel security concerns such as Tool Poisoning Attack (TPA), which exploit LLM-server interactions to inject malicious prompts. Existing poisoning schemes typically adopt a monolithic plaintext embedding paradigm, which fails to withstand manual inspection or automated detectors. Current research still lacks a systematic analysis on multi-tool poisoning, where multiple tools can be exploited cooperatively to disperse detection risk. In this paper, we introduce ShareLock, a multi-tool threshold poisoning framework that utilizes Shamir's threshold scheme to ensure exceptional stealth and fault tolerance. ShareLock distributes the malicious instruction as benign-looking secret shares across multiple tool descriptions, achieving both information-theoretic secrecy and attack robustness against moderate auditing. After a covert reconstruction trigger is planted during server update, the aggregated shares reconstruct the hidden instruction, resulting in critical breaches of system assets or private data. To evaluate the realistic threat of ShareLock, we constructed a comprehensive benchmark encompassing four multi-tool scenarios and conducted extensive experiments across mainstream LLMs on two distinct MCP clients. Our results demonstrate that ShareLock significantly outperforms existing single-tool poisoning strategies in tool description-based detection while maintaining an average attack success rate exceeding 90%.