首次系统检测多服务器代理中非恶意的凭证跨边界传播问题。
MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents
- 用蜜罐追踪技术将传播检测转为字符串匹配，精准定位凭证泄露。
- 在5个模型147个任务中发现11.5%至41.3%的策略违规传播率。
- 揭示浏览器数据流是主要传播路径，提示需从指令层面加强防御。
多服务器MCP代理引发信息流控制难题：看似无害的读写权限组合，可能因工作流拓扑结构导致跨信任边界凭证传播——这是结构性副作用，而非恶意行为。本文提出MCPHunt，据我们所知首个可控基准，专门隔离非对抗性、逐字级凭证传播。方法上：(1) 基于蜜罐的污染追踪，将传播检测简化为客观字符串匹配；(2) 环境受控的覆盖率设计，包含高风险、良性及硬负例条件，验证流水线正确性并排除凭证格式干扰；(3) CRS分层分析，区分任务必需传播（忠实执行传输指令）与策略违规传播（本可擦除却仍携带凭证）。在涵盖5个模型、147项任务、9类机制的3,615条主基准轨迹中，策略违规传播率达11.5%–41.3%。传播具有路径特异性（跨机制差异达25倍），集中于浏览器媒介数据流；硬负例控制表明，生产格式凭证非必要，仅靠提示引导的跨边界数据流即可触发传播。对3个模型的提示缓解研究显示，政策违规传播最高可降低97%，同时保留80.5%效用，但效果随指令遵循能力变化，提示仅靠提示层防御或不足。代码、轨迹及标注管道已开源（MIT和CC BY 4.0）。
原文摘要 · Abstract (English)
Multi-server MCP agents create an information-flow control problem: faithful tool composition can turn individually benign read/write permissions into cross-boundary credential propagation -- a structural side effect of workflow topology, not necessarily malicious model behavior. We present MCPHunt, to our knowledge the first controlled benchmark that isolates non-adversarial, verbatim credential propagation across multi-server MCP trust boundaries, with three methodological contributions: (1) canary-based taint tracking that reduces propagation detection to objective string matching; (2) an environment-controlled coverage design with risky, benign, and hard-negative conditions that validates pipeline soundness and controls for credential-format confounds; (3) CRS stratification that disentangles task-mandated propagation (faithful execution of verbatim-transfer instructions) from policy-violating propagation (credentials included despite the option to redact). Across 3,615 main-benchmark traces from 5 models spanning 147 tasks and 9 mechanism families, policy-violating propagation rates reach 11.5--41.3% across all models. This propagation is pathway-specific (25x cross-mechanism range) and concentrated in browser-mediated data flows; hard-negative controls provide evidence that production-format credentials are not necessary -- prompt-directed cross-boundary data flow is sufficient. A prompt-mitigation study across 3 models reduces policy-violating propagation by up to 97% while preserving 80.5% utility, but effectiveness varies with instruction-following capability -- suggesting that prompt-level defenses alone may not suffice. Code, traces, and labeling pipeline are released under MIT and CC BY 4.0.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。