Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

Source

arXiv

arxiv.org/abs/2606.27027v1

Read the source

Source

Plain-Language Brief

The paper introduces a new multi-tool threshold poisoning framework called ShareLock. This framework uses Shamir's threshold scheme to distribute malicious instructions across multiple tool descriptions, making it hard for detection and maintaining high success rates in attacks against MCP clients.

What the Document Says

  • ShareLock is a multi-tool poisoning framework that utilizes Shamir's threshold scheme.
  • The malicious instruction is distributed as secret shares across multiple tool descriptions.
  • ShareLock ensures information-theoretic secrecy and attack robustness against moderate auditing.
  • A covert reconstruction trigger is planted during server update.
  • The aggregated shares reconstruct the hidden instruction, leading to breaches of system assets or private data.
  • ShareLock outperforms existing single-tool poisoning strategies in tool description-based detection.
  • The average attack success rate exceeds 90%.

Key Concepts Mentioned

  • ShareLock
  • Multi-tool poisoning framework
  • Shamir's threshold scheme
  • Malicious instruction
  • Secret shares
  • Information-theoretic secrecy
  • Attack robustness
  • Covert reconstruction trigger
  • System assets
  • Private data

Claims Made by the Document

  • ShareLock is more stealthy and fault-tolerant than existing poisoning schemes.
  • ShareLock outperforms existing single-tool poisoning strategies in tool description-based detection.

Evidence Used

  • The paper describes the ShareLock framework and its mechanisms.
  • Results from experiments demonstrate the performance of ShareLock.

Methods / Approach

  • Use of Shamir's threshold scheme
  • Distribution of malicious instructions as secret shares
  • Planting a covert reconstruction trigger during server update

Limitations Stated by the Authors

The paper does not provide details on how to defend against ShareLock.

Limitations Noted by the Agent

Agent interpretation — not from the source.

The effectiveness of the framework in real-world scenarios may vary and depend on factors such as the specific MCP clients, LLMs, and detection mechanisms used.

Open Questions

  • How can systems be defended against ShareLock attacks?

Notes for Future Q&A

May include interpretation. Labeled where it does.

Discuss potential countermeasures and defense strategies for ShareLock attacks.

Raw Abstract / Excerpt

With the rapid evolution of LLM-driven agents, Model Context Protocol (MCP), an open protocol bridging LLMs with external tools, has quickly become foundational to modern agent ecosystems. However, the expanding adoption of MCP has also introduced novel security concerns such as Tool Poisoning Attack (TPA), which exploit LLM-server interactions to inject malicious prompts. Existing poisoning schemes typically adopt a monolithic plaintext embedding paradigm, which fails to withstand manual inspection or automated detectors. Current research still lacks a systematic analysis on multi-tool poisoning, where multiple tools can be exploited cooperatively to disperse detection risk. In this paper, we introduce ShareLock, a multi-tool threshold poisoning framework that utilizes Shamir's threshold scheme to ensure exceptional stealth and fault tolerance. ShareLock distributes the malicious instruction as benign-looking secret shares across multiple tool descriptions, achieving both information-theoretic secrecy and attack robustness against moderate auditing. After a covert reconstruction trigger is planted during server update, the aggregated shares reconstruct the hidden instruction, resulting in critical breaches of system assets or private data. To evaluate the realistic threat of ShareLock, we constructed a comprehensive benchmark encompassing four multi-tool scenarios and conducted extensive experiments across mainstream LLMs on two distinct MCP clients. Our results demonstrate that ShareLock significantly outperforms existing single-tool poisoning strategies in tool description-based detection while maintaining an average attack success rate exceeding 90%.