MCP Tool Attacks Bypass Mainstream LLM Safety Guardrails

mlsandwich · reddit · 2026-07-09

Traditional LLM safety alignment treats attack detection as a text classification problem, which fails for agents equipped with real tool-calling capabilities. Researchers have proposed a new attack paradigm: converting known public security vulnerabilities (CVEs) into tool-call sequences, and then having an LLM rewrite them into seemingly benign natural language requests to bypass text-based safety filters.

In tests based on the Model Context Protocol (MCP), no foundation models (1B-14B parameters) could reject more than 35% of these attacks. Even SOTA safety fine-tuning methods (like DPO and SafeDPO) only increased the rejection rate to 48%. In contrast, training-free methods performed significantly better, achieving a rejection rate up to three times that of the baseline. The researchers have open-sourced the related code, datasets, and paper.

Original post →

More from Safety

Safety channel →