{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,7]],"date-time":"2026-07-07T15:16:16Z","timestamp":1783437376479,"version":"3.54.6"},"reference-count":64,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100013287","name":"Science Challenge Project","doi-asserted-by":"publisher","award":["TZ2025005"],"award-info":[{"award-number":["TZ2025005"]}],"id":[{"id":"10.13039\/501100013287","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2441239"],"award-info":[{"award-number":["U2441239"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U24A20336"],"award-info":[{"award-number":["U24A20336"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62402418"],"award-info":[{"award-number":["62402418"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"publisher","award":["2024M762829"],"award-info":[{"award-number":["2024M762829"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"publisher","award":["2025M781523"],"award-info":[{"award-number":["2025M781523"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"publisher","award":["2025M781522"],"award-info":[{"award-number":["2025M781522"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Zhejiang Key Laboratory of Decision Intelligence","award":["2025E10006"],"award-info":[{"award-number":["2025E10006"]}]},{"name":"Zhejiang Provincial Natural Science Foundation Exploration of China","award":["LMS26F020003"],"award-info":[{"award-number":["LMS26F020003"]}]},{"name":"State Key Laboratory of Cryptography and Digital Economy Security","award":["KFYB2504"],"award-info":[{"award-number":["KFYB2504"]}]},{"DOI":"10.13039\/501100004731","name":"Natural Science Foundation of Zhejiang Province","doi-asserted-by":"publisher","award":["LD24F020002"],"award-info":[{"award-number":["LD24F020002"]}],"id":[{"id":"10.13039\/501100004731","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Pioneer and Leading Goose Research and Development Program of Zhejiang","award":["2025C02033"],"award-info":[{"award-number":["2025C02033"]}]},{"name":"Pioneer and Leading Goose Research and Development Program of Zhejiang","award":["2025C01082"],"award-info":[{"award-number":["2025C01082"]}]},{"name":"Pioneer and Leading Goose Research and Development Program of Zhejiang","award":["2026C02A1233"],"award-info":[{"award-number":["2026C02A1233"]}]},{"name":"Pioneer and Leading Goose Research and Development Program of Zhejiang","award":["2025C02034"],"award-info":[{"award-number":["2025C02034"]}]},{"name":"Ningbo Yongjiang Talent Project"},{"name":"Research Project of Quancheng Laboratory, China","award":["QCL20250107"],"award-info":[{"award-number":["QCL20250107"]}]},{"name":"Zhejiang University College of Computer Science and Technology"},{"name":"Zhejiang University Next Generation Industrial Control System (NGICS) Platform"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3691201","type":"journal-article","created":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T19:52:19Z","timestamp":1778183539000},"page":"5165-5180","source":"Crossref","is-referenced-by-count":1,"title":["Automatic Red Teaming LLM-Based Agents With Model Context Protocol Tools"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-9911-7897","authenticated-orcid":false,"given":"Ping","family":"He","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1671-7183","authenticated-orcid":false,"given":"Changjiang","family":"Li","sequence":"additional","affiliation":[{"name":"Palo Alto Networks, Santa Clara, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2025-1291","authenticated-orcid":false,"given":"Binbin","family":"Zhao","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0896-0690","authenticated-orcid":false,"given":"Tianyu","family":"Du","sequence":"additional","affiliation":[{"name":"School of Software Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4268-372X","authenticated-orcid":false,"given":"Shouling","family":"Ji","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.4841493"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671801"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1601"},{"key":"ref4","article-title":"Patchpilot: A stable and cost-efficient agentic patching framework","author":"Li","year":"2025","journal-title":"arXiv:2502.02747"},{"key":"ref5","article-title":"Deep research agents: A systematic examination and roadmap","author":"Huang","year":"2025","journal-title":"arXiv:2506.18096"},{"key":"ref6","volume-title":"Tool Use With Claude","year":"2025"},{"key":"ref7","volume-title":"Model Context Protocol","year":"2025"},{"key":"ref8","volume-title":"Tool Poisoning Attacks in the Model Context Protocol","author":"Labs","year":"2025"},{"key":"ref9","volume-title":"PyPI","author":"Foundation","year":"2025"},{"key":"ref10","volume-title":"Npm Registry","year":"2025"},{"key":"ref11","volume-title":"MCP.so","year":"2025"},{"key":"ref12","volume-title":"Smithery","year":"2025"},{"key":"ref13","volume-title":"Mcp Server Shared in Reddit","year":"2026"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179304"},{"key":"ref15","article-title":"We should identify and mitigate third-party safety risks in MCP-powered agent systems","author":"Fang","year":"2025","journal-title":"arXiv:2506.13666"},{"key":"ref16","article-title":"Beyond the protocol: Unveiling attack vectors in the model context protocol ecosystem","author":"Song","year":"2025","journal-title":"arXiv:2506.02040v2"},{"key":"ref17","volume-title":"MCP-Scan","author":"Labs","year":"2025"},{"key":"ref18","volume-title":"AI-Infra-Guard","year":"2025"},{"key":"ref19","first-page":"1831","article-title":"Formalizing and benchmarking prompt injection attacks and defenses","volume-title":"Proc. USENIX Security Symp.","author":"Liu"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3690624.3709179"},{"key":"ref21","volume-title":"Claude Desktop","year":"2025"},{"key":"ref22","volume-title":"Cline","year":"2025"},{"key":"ref23","volume-title":"Cursor","year":"2026"},{"key":"ref24","volume-title":"Windsurf","year":"2026"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3807666"},{"key":"ref26","article-title":"ReAct: Synergizing reasoning and acting in language models","volume-title":"Proc. 11th Int. Conf. Learn. Represent.","author":"Yao"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3796519"},{"key":"ref28","article-title":"Enterprise-grade security for the model context protocol (MCP): Frameworks and mitigation strategies","author":"Narajala","year":"2025","journal-title":"arXiv:2504.08623"},{"key":"ref29","article-title":"Exploit tool invocation prompt for tool behavior hijacking in LLM-based agentic system","author":"Liu","year":"2025","journal-title":"arXiv:2509.05755v4"},{"key":"ref30","volume-title":"Tencent Security Report on Malicious Mcp Server","author":"Center","year":"2026"},{"key":"ref31","article-title":"Les dissonances: Cross-tool harvesting and polluting in multi-tool empowered LLM agents","author":"Li","year":"2025","journal-title":"arXiv:2504.03111"},{"key":"ref32","first-page":"3630","article-title":"Matching networks for one shot learning","volume-title":"Proc. NeurIPS","author":"Vinyals"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1800"},{"key":"ref34","article-title":"A survey on LLM-as-a-judge","author":"Gu","year":"2024","journal-title":"arXiv:2411.15594"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2020"},{"key":"ref36","article-title":"From generation to judgment: Opportunities and challenges of LLM-as-a-judge","author":"Li","year":"2024","journal-title":"arXiv:2411.16594"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP55912.2026.11465040"},{"key":"ref38","volume-title":"LangGraph","year":"2025"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623117"},{"key":"ref40","article-title":"Defending against adversarial malware attacks on ml-based Android malware detection systems","author":"He","year":"2025","journal-title":"arXiv:2501.13782"},{"key":"ref41","volume-title":"Alpaca MCP Server","year":"2025"},{"key":"ref42","volume-title":"WhatsApp MCP Server","author":"Harries","year":"2025"},{"key":"ref43","volume-title":"Filesystem MCP Server","year":"2025"},{"key":"ref44","article-title":"Masterkey: Automated jailbreak across multiple large language model chatbots","volume":"abs\/2307.08715","author":"Deng","year":"2023","journal-title":"CoRR"},{"key":"ref45","article-title":"GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts","author":"Yu","year":"2023","journal-title":"arXiv:2309.10253"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00250"},{"key":"ref47","article-title":"Meta secalign: A secure foundation LLM against prompt injection attacks","author":"Chen","year":"2025","journal-title":"arXiv:2507.02735"},{"key":"ref48","article-title":"Struq: Defending against prompt injection with structured queries","author":"Chen","year":"2024","journal-title":"arXiv:2402.06363"},{"key":"ref49","article-title":"Secalign: Defending against prompt injection with preference optimization","author":"Chen","year":"2024","journal-title":"arXiv:2410.05451"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2026.230675"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"ref52","article-title":"A critical evaluation of defenses against prompt injection attacks","author":"Jia","year":"2025","journal-title":"arXiv:2505.18333"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690291"},{"key":"ref54","article-title":"Defeating prompt injections by design","author":"Debenedetti","year":"2025","journal-title":"arXiv:2503.18813"},{"key":"ref55","article-title":"Prompt injection attack against llm-integrated applications","author":"Liu","year":"2023","journal-title":"arXiv:2306.05499"},{"key":"ref56","article-title":"Automatic and universal prompt injection attacks against large language models","author":"Liu","year":"2024","journal-title":"arXiv:2403.04957"},{"key":"ref57","article-title":"Design patterns for securing llm agents against prompt injections","author":"Beurer-Kellner","year":"2025","journal-title":"arXiv:2506.08837"},{"key":"ref58","first-page":"3767","article-title":"Make agent defeat agent: Automatic detection of taint-style vulnerabilities in LLM-based agents","volume-title":"Proc. USENIX Secur.","author":"Liu"},{"key":"ref59","article-title":"AgentVigil: Generic black-box red-teaming for indirect prompt injection against LLM agents","author":"Wang","year":"2025","journal-title":"arXiv:2505.05849"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3369"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2636"},{"key":"ref62","article-title":"From allies to adversaries: Manipulating LLM tool-calling through adversarial injection","author":"Wang","year":"2024","journal-title":"arXiv:2412.10198"},{"key":"ref63","article-title":"Prompt infection: LLM-to-LLM prompt injection within multi-agent systems","author":"Lee","year":"2024","journal-title":"arXiv:2410.07283"},{"key":"ref64","article-title":"EnvInjection: Environmental Prompt Injection Attack to Multi-modal web Agents","author":"Wang","year":"2025","journal-title":"arXiv:2505.11717v1"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11511784.pdf?arnumber=11511784","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T19:39:17Z","timestamp":1780515557000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11511784\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":64,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3691201","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}