Research
Confused Deputy Attack against Model Context Protocol
Publication date unknown · Discovered acm.org
Page published
Publication date unknown · First observed: 10 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
MCP metadata manipulation can redirect agent workflows to attacker-controlled tools without overtly malicious instructions, exposing gaps in scanners that do not assess tool-selection integrity.
The study “Confused Deputy Attack against Model Context Protocol” demonstrates how adversarial MCP servers can manipulate tool descriptions and names to divert invocations from benign tools. Researchers evaluated their Puppet framework across 14 models from six providers on two MCP hosts, reporting tool-selection hijacking rates up to 90.89% and malicious payload execution rates up to 86.46%. The tested metadata manipulations evaded MCP-Scan and McpSafetyScanner, and reasoning-enabled models were more vulnerable than their non-reasoning counterparts.