Research map / Multi-agent systems and games / LLM agents

MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces MCPHunt, a canary-based benchmark measuring non-adversarial cross-boundary credential propagation in multi-server MCP agents across 5 models, 147 tasks, and 9 mechanism families.

Problem

Multi-server MCP agents can propagate credentials across trust boundaries during faithful, non-adversarial task execution, yet no benchmark measures this compositional data-propagation risk.

Approach

Canary-based taint tracking with format-authentic secrets reduces propagation detection to string matching; environment-controlled risky/benign/hard-negative conditions and CRS stratification separate task-mandated transfer from policy-violating propagation.

Key results

• Policy-violating propagation rates range 11.5–41.3% across 5 models on risky environments.
• Prompt mitigation M3 reduces GPT-5.4 policy-violating propagation from 13.9% to 0.3% (97% relative reduction) with 80.5% utility.
• browser_to_local mechanism shows 74.4% propagation for GPT-5.4 versus 0% for indirect_exposure; mechanism family explains 62% of pseudo-R² improvement versus 32% for model identity.

Surprising findings

• Generic privacy reminders (M1) yield at most modest reductions and 0% change for DeepSeek-V4-Flash.
• Stronger utility does not imply lower propagation: MiniMax-M2.7 has the highest utility (92.2%) and highest propagation (45.2%).

Limitations

• Canaries are verbatim; paraphrased propagation is missed.
• All 147 tasks are researcher-designed synthetic tasks.
• Runtime taint guard is evaluated only post-hoc on existing traces.

Experimental setup

Datasets: 147 researcher-designed MCP tasks

Benchmarks: MCPHunt

Metrics: policy-violating propagation rate propagation rate utility rate Wilson 95% CI Cohen's kappa

Baselines: MCP-SafetyBench MCPSecBench MSB TOP-Bench AgentLeak

Builds on: Model Context Protocol TOP-Bench NeMo Guardrails

Closest papers by meaning

• MCP-Atlas: A Large-Scale Benchmark for Tool-Use Competency with Real MCP Servers (NeurIPS 2026 · similarity 0.88)
• MCPTox: A Benchmark for Tool Poisoning on Real-World MCP Servers (AAAI 2026 · similarity 0.86)
• SecureClaw: Clawing Back Control of LLM Agents (NeurIPS 2026 · similarity 0.85)
• AgentCollabBench: Diagnosing When Good Agents Make Bad Collaborators (NeurIPS 2026 · similarity 0.85)
• MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents (NeurIPS 2026 · similarity 0.85)
• AI Agents May Always Fall for Prompt Injections (NeurIPS 2026 · similarity 0.85)