ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Liwei Liu, Tianzhu Han, Zijian Liu, Zishu Dong, Na Ruan
• Venue: arXiv: cs.CR
• Published: 2026-06-25
• Collected: 2026-06-26
• URL: http://arxiv.org/abs/2606.27027v1
• PDF: https://arxiv.org/pdf/2606.27027v1
• DOI: UNKNOWN

Plain-Language Brief

The paper introduces a new method called ShareLock, which is a multi-tool threshold poisoning framework that can exploit the interactions between Language Model servers and external tools. This method is designed to inject malicious prompts in a stealthy manner and avoid detection by using Shamir's threshold scheme for information dispersal across multiple tool descriptions.

What the Document Says

• The paper discusses ShareLock, a framework for multi-tool threshold poisoning attacks
• ShareLock utilizes Shamir's threshold scheme to disperse malicious instructions across multiple tool descriptions
• This dispersal ensures information-theoretic secrecy and attack robustness against moderate auditing
• After a covert reconstruction trigger, the shares are aggregated and the hidden instruction is reconstructed
• The results show that ShareLock outperforms existing single-tool poisoning strategies in tool description-based detection with an average attack success rate exceeding 90%

Key Concepts Mentioned

• ShareLock
• Multi-tool threshold poisoning
• Shamir's threshold scheme
• Language Model servers
• External tools
• Malicious prompts
• Tool description-based detection

Claims Made by the Document

• ShareLock is a stealthy and fault-tolerant multi-tool poisoning framework
• The method maintains information-theoretic secrecy and attack robustness against moderate auditing
• ShareLock outperforms existing single-tool poisoning strategies in tool description-based detection with an average attack success rate exceeding 90%

Evidence Used

• The paper describes the ShareLock framework, its implementation details, and experimental results

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

With the rapid evolution of LLM-driven agents, Model Context Protocol (MCP), an open protocol bridging LLMs with external tools, has quickly become foundational to modern agent ecosystems. However, the expanding adoption of MCP has also introduced novel security concerns such as Tool Poisoning Attack (TPA), which exploit LLM-server interactions to inject malicious prompts. Existing poisoning schemes typically adopt a monolithic plaintext embedding paradigm, which fails to withstand manual inspection or automated detectors. Current research still lacks a systematic analysis on multi-tool poisoning, where multiple tools can be exploited cooperatively to disperse detection risk. In this paper, we introduce ShareLock, a multi-tool threshold poisoning framework that utilizes Shamir's threshold scheme to ensure exceptional stealth and fault tolerance. ShareLock distributes the malicious instruction as benign-looking secret shares across multiple tool descriptions, achieving both information-theoretic secrecy and attack robustness against moderate auditing. After a covert reconstruction trigger is planted during server update, the aggregated shares reconstruct the hidden instruction, resulting in critical breaches of system assets or private data. To evaluate the realistic threat of ShareLock, we constructed a comprehensive benchmark encompassing four multi-tool scenarios and conducted extensive experiments across mainstream LLMs on two distinct MCP clients. Our results demonstrate that ShareLock significantly outperforms existing single-tool poisoning strategies in tool description-based detection while maintaining an average attack success rate exceeding 90%.