ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

The Model Context Protocol (MCP) has become a standard for connecting Large Language Models (LLMs) to external tools. While this ecosystem enables powerful agentic workflows, it introduces significant security risks. Previous research identified Tool Poisoning Attacks (TPA), where malicious instructions are embedded in tool descriptions to hijack agent behavior. However, existing attacks typically rely on monolithic, plaintext injections that are easily flagged by human auditors or automated security scanners. This paper addresses the lack of systematic analysis regarding multi-tool poisoning, where attackers can distribute malicious payloads to improve stealth and robustness.

ShareLock introduces a threshold-based poisoning strategy inspired by Shamir’s Secret Sharing. Instead of embedding a complete malicious instruction in a single tool, ShareLock fragments the payload into multiple cryptographic shares. These shares are disguised as benign metadata within the descriptions of several different tools. The attack is designed so that the malicious instruction remains latent and innocuous until a specific reconstruction trigger—introduced during a server update—causes the LLM to aggregate the shares. This approach provides information-theoretic secrecy, as no individual tool description contains enough information to reveal the malicious intent, and it offers fault tolerance, meaning the attack can still succeed even if some of the poisoned tools are removed by security filters.

The authors evaluated ShareLock using a benchmark covering four domains: Travel, Coding, Finance, and Office. Testing across mainstream LLMs and two popular MCP clients (Cherry Studio and Cline) demonstrated that ShareLock significantly outperforms traditional single-tool poisoning methods. By dispersing the adversarial payload, the framework maintains an average attack success rate exceeding 90% while remaining highly evasive against standard safety classification models. This work highlights the critical need for security mechanisms in agent systems that can detect distributed, multi-component threats rather than focusing solely on individual tool descriptions.