恶意工具链诱导智能体陷入循环计算，大幅增加资源消耗却无异常表现。
Overthinking Loops in Agents: A Structural Risk via MCP Tools
- 通过伪造工具服务器制造循环调用路径，利用正常工具调用的组合引发过思循环。
- 攻击导致端到端令牌数最高膨胀142.4倍，任务延迟显著上升且结果受损。
- 适用于研究智能体安全、工具链设计及对抗性防御的开发者与安全研究人员。
使用外部工具的大型语言模型智能体通过文本可见的元数据（如工具名、描述、返回消息）选择并串联第三方工具来协调真实工作负载。我们发现，这种便利性带来了供应链攻击面：恶意的MCP工具服务器可与正常工具共注册，并诱导过思循环，即单个工具调用看似平凡或合理，但组合后形成循环轨迹，导致端到端令牌数和延迟激增，而每个步骤均无异常。我们将此现象形式化为结构化过思攻击，区别于单纯的令牌冗余。我们在三个服务器上实现14个恶意工具，触发重复、强制优化和分心等行为。在异构工具注册表和多个工具型模型上，该攻击造成严重资源放大（最高达142.4×令牌），并损害任务结果。此外，解码阶段的简洁控制无法可靠防止循环诱导，表明防御需关注工具调用结构而非仅令牌数量。
原文摘要 · Abstract (English)
Tool-using LLM agents increasingly coordinate real workloads by selecting and chaining third-party tools based on text-visible metadata such as tool names, descriptions, and return messages. We show that this convenience creates a supply-chain attack surface: a malicious MCP tool server can be co-registered alongside normal tools and induce overthinking loops, where individually trivial or plausible tool calls compose into cyclic trajectories that inflate end-to-end tokens and latency without any single step looking abnormal. We formalize this as a structural overthinking attack, distinguishable from token-level verbosity, and implement 14 malicious tools across three servers that trigger repetition, forced refinement, and distraction. Across heterogeneous registries and multiple tool-capable models, the attack causes severe resource amplification (up to $142.4\times$ tokens) and can degrade task outcomes. Finally, we find that decoding-time concision controls do not reliably prevent loop induction, suggesting defenses should reason about tool-call structure rather than tokens alone.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。