MCPVenom: benchmark of tool-output prompt injection in MCP agent frameworks

Evidence record

Primary paper compares 12 frameworks and 18 models over 45 injection scenarios: 9,720 test cells, 2,113 vulnerable outcomes, and 255 verified canary exfiltration results.

Read the original source ↗

Claim-level citations (3)

• supportsMCPVenom found model-tool trust failures across MCP clients: MCPVenom designed 9,720 framework-model-scenario cells: 2,113 were labeled vulnerable, 7,102 resistant, 237 errored and 268 skipped. The study's 22.9% attack-success rate is 2,113 of the 9,215 vulnerable-or-resistant cells, not 2,113 divided by all 9,720 designed cells.

  Section 6.1, Table 3, Total row (V=2,113; R=7,102; E=237; S=268; ASR 22.9%)

• supportsMCPVenom found model-tool trust failures across MCP clients: The authors separately verified 255 canary exfiltration outcomes, which is not the same quantity as all vulnerable outcomes.

  Canary exfiltration verification results

• supportsMCPVenom found model-tool trust failures across MCP clients: Among 2,113 vulnerable outcomes, the authors reported 1,371 dispatch-level events, 487 confirmed network contacts and 255 canary-secret exfiltration receipts; their headline 22.9% rate excludes error or skipped cells from its effective denominator.

  Section 6, Tables 4 and 6; dual-oracle definitions