{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T08:17:07Z","timestamp":1783153027485,"version":"3.54.6"},"publisher-location":"New York, NY, USA","reference-count":28,"publisher":"ACM","funder":[{"name":"Quantum Science and Technology National Science and Technology Major Project(QNMP)","award":["2021ZD0302900"],"award-info":[{"award-number":["2021ZD0302900"]}]},{"name":"China National Natural Science Foundation","award":["92567301"],"award-info":[{"award-number":["92567301"]}]},{"name":"China National Natural Science Foundation","award":["62132018"],"award-info":[{"award-number":["62132018"]}]},{"name":"China National Natural Science Foundation","award":["62231015"],"award-info":[{"award-number":["62231015"]}]},{"name":"\"Pioneer\" and \"Leading Goose\" R&D Program of Zhejiang","award":["2025C02044"],"award-info":[{"award-number":["2025C02044"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,13]]},"DOI":"10.1145\/3774904.3792400","type":"proceedings-article","created":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T12:38:33Z","timestamp":1777293513000},"page":"2974-2982","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Beyond Detection: Autonomous Anomaly Remediation for MCP Against Tool Poisoning Attacks"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0398-2631","authenticated-orcid":false,"given":"Zhiqiang","family":"Wang","sequence":"first","affiliation":[{"name":"University of Science and Technology of China, Hefei, Anhui, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-1552-7621","authenticated-orcid":false,"given":"Guanquan","family":"Shi","sequence":"additional","affiliation":[{"name":"Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-6593-0523","authenticated-orcid":false,"given":"Yanting","family":"Wang","sequence":"additional","affiliation":[{"name":"Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-3109-1135","authenticated-orcid":false,"given":"Yichao","family":"Gao","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-5416-0315","authenticated-orcid":false,"given":"Hongsen","family":"Lang","sequence":"additional","affiliation":[{"name":"Shandong University, Jinan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7433-3145","authenticated-orcid":false,"given":"Yunhao","family":"Yao","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8492-3990","authenticated-orcid":false,"given":"Haohua","family":"Du","sequence":"additional","affiliation":[{"name":"Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6070-6625","authenticated-orcid":false,"given":"Xiang-Yang","family":"Li","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Adfin MCP Server. https:\/\/github.com\/Adfin-Engineering\/mcp-server-adfin. GitHub repository, accessed","author":"Engineering Adfin","year":"2025","unstructured":"Adfin Engineering. 2024. Adfin MCP Server. https:\/\/github.com\/Adfin-Engineering\/mcp-server-adfin. GitHub repository, accessed October 2025."},{"key":"e_1_3_2_1_2_1","first-page":"2025","article-title":"Introducing the Model Context Protocol. URL: https:\/\/www. anthropic.com\/news\/model-contextprotocol","volume":"19","author":"Anthropic PBC","year":"2024","unstructured":"PBC Anthropic. 2024. Introducing the Model Context Protocol. URL: https:\/\/www. anthropic.com\/news\/model-contextprotocol, Accessed, Vol. 19 (2024), 2025.","journal-title":"Accessed"},{"key":"e_1_3_2_1_3_1","unstructured":"MITRE ATLAS. 2025. AI Agent Context Poisoning. MITRE. https:\/\/atlas.mitre.org\/techniques\/AML.T0080"},{"key":"e_1_3_2_1_4_1","unstructured":"Jinze Bai Shuai Bai Yunfei Chu Zeyu Cui Kai Dang Xiaodong Deng Yang Fan Wenbin Ge Yu Han Fei Huang et al. 2023. Qwen Technical Report. arXiv:2309.16609 [cs.CL]"},{"key":"e_1_3_2_1_5_1","volume-title":"MCP Google Maps Server. https:\/\/github.com\/cablate\/mcp-google-map. GitHub repository, accessed","year":"2025","unstructured":"Cablate. 2024. MCP Google Maps Server. https:\/\/github.com\/cablate\/mcp-google-map. GitHub repository, accessed October 2025."},{"key":"e_1_3_2_1_6_1","volume-title":"Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Data. arXiv preprint arXiv:2507.19880","author":"Croce Nicola","year":"2025","unstructured":"Nicola Croce and Tobin South. 2025. Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Data. arXiv preprint arXiv:2507.19880 (2025)."},{"key":"e_1_3_2_1_7_1","volume-title":"Dodo Payments MCP Server. https:\/\/github.com\/dodopayments\/dodopayments-typescript\/tree\/main\/packages\/mcp-server. GitHub repository, accessed","author":"Payments Dodo","year":"2025","unstructured":"Dodo Payments. 2024. Dodo Payments MCP Server. https:\/\/github.com\/dodopayments\/dodopayments-typescript\/tree\/main\/packages\/mcp-server. GitHub repository, accessed October 2025."},{"key":"e_1_3_2_1_8_1","volume-title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems. arXiv preprint arXiv:2506.13666","author":"Fang Junfeng","year":"2025","unstructured":"Junfeng Fang, Zijun Yao, Ruipeng Wang, Haokai Ma, Xiang Wang, and Tat-Seng Chua. 2025. We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems. arXiv preprint arXiv:2506.13666 (2025)."},{"key":"e_1_3_2_1_9_1","volume-title":"Gemini: A Family of Highly Capable Multimodal Models. arXiv:2312.11805 [cs.CL]","author":"Team Gemini","year":"2023","unstructured":"Gemini Team, et al., 2023. Gemini: A Family of Highly Capable Multimodal Models. arXiv:2312.11805 [cs.CL]"},{"key":"e_1_3_2_1_10_1","unstructured":"Hechuan Guo Yongle Hao Yue Zhang Minghui Xu Peizhuo Lyu Jiezhi Chen and Xiuzhen Cheng. 2025. A Measurement Study of Model Context Protocol. arXiv:2509.25292 [cs.CY] https:\/\/arxiv.org\/abs\/2509.25292"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"crossref","unstructured":"Xinyi Hou Yanjie Zhao Shenao Wang and Haoyu Wang. 2025. Model Context Protocol (MCP): Landscape Security Threats and Future Research Directions. arXiv:2503.23278 [cs.CR] https:\/\/arxiv.org\/abs\/2503.23278","DOI":"10.1145\/3796519"},{"key":"e_1_3_2_1_12_1","unstructured":"Invariant Labs. 2025a. MCP-Scan Documentation. https:\/\/explorer.invariantlabs.ai\/docs\/mcp-scan\/. Accessed: 2025-07-25."},{"key":"e_1_3_2_1_13_1","unstructured":"Invariant Labs. 2025b. WhatsApp MCP Exploited: Exfiltrating your message history via MCP. https:\/\/invariantlabs.ai\/blog\/whatsapp-mcp-exploited. Accessed:2025-08-07."},{"key":"e_1_3_2_1_14_1","volume-title":"Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al.","author":"Jiang Albert Q.","year":"2023","unstructured":"Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al., 2023. Mistral 7B. arXiv:2310.06825 [cs.CL]"},{"key":"e_1_3_2_1_15_1","volume-title":"MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol. arXiv:2505.14590 [cs.CL] https:\/\/arxiv.org\/abs\/2505.14590","author":"Jing Huihao","year":"2025","unstructured":"Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Heli Xu, Tianshu Chu, Peizhao Hu, and Yangqiu Song. 2025. MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol. arXiv:2505.14590 [cs.CL] https:\/\/arxiv.org\/abs\/2505.14590"},{"key":"e_1_3_2_1_16_1","unstructured":"Simcha Kosman. 2025. Poison everywhere: No output from your MCP server is safe. CYBERARK. https:\/\/www.cyberark.com\/resources\/threat-research-blog\/poison-everywhere-no-output-from-your-mcp-server-is-safe"},{"key":"e_1_3_2_1_17_1","unstructured":"Invariant Labs. 2025. MCP Security Notification: Tool Poisoning Attacks. https:\/\/invariantlabs.ai\/blog\/mcp-security-notification-tool-poisoning-attacks. Accessed: 2025-07-24."},{"key":"e_1_3_2_1_18_1","unstructured":"Weiwen Liu Xu Huang Xingshan Zeng Xinlong Hao Shuai Yu Dexun Li Shuai Wang Weinan Gan Zhengying Liu Yuanqing Yu Zezhong Wang Yuxian Wang Wu Ning Yutai Hou Bin Wang Chuhan Wu Xinzhi Wang Yong Liu Yasheng Wang Duyu Tang Dandan Tu Lifeng Shang Xin Jiang Ruiming Tang Defu Lian Qun Liu and Enhong Chen. 2025. ToolACE: Winning the Points of LLM Function Calling. arXiv:2409.00920 [cs.LG] https:\/\/arxiv.org\/abs\/2409.00920"},{"key":"e_1_3_2_1_19_1","first-page":"27","article-title":"Artificial intelligence-assisted classification of library resources: The case of Claude AI","volume":"2","author":"Martins Sugabsen","year":"2024","unstructured":"Sugabsen Martins. 2024. Artificial intelligence-assisted classification of library resources: The case of Claude AI. Artificial Intelligence, Vol. 2 (2024), 27-2024.","journal-title":"Artificial Intelligence"},{"key":"e_1_3_2_1_20_1","unstructured":"Liv Matan. 2025. The Trifecta: How Three New Gemini Vulnerabilities in Cloud Assist Search Model and Browsing Allowed Private Data Exfiltration. Tenable. https:\/\/www.tenable.com\/blog\/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing"},{"key":"e_1_3_2_1_21_1","unstructured":"Gr\u00e9goire Mialon Roberto Dess\u00ec Maria Lomeli Christoforos Nalmpantis Ram Pasunuru Roberta Raileanu Baptiste Rozi\u00e8re Timo Schick Jane Dwivedi-Yu Asli Celikyilmaz Edouard Grave Yann LeCun and Thomas Scialom. 2023. Augmented Language Models: a Survey. arXiv:2302.07842 [cs.CL] https:\/\/arxiv.org\/abs\/2302.07842"},{"key":"e_1_3_2_1_22_1","volume-title":"Playwright MCP: A Model Context Protocol server for browser automation. https:\/\/github.com\/microsoft\/playwright-mcp GitHub repository, accessed","year":"2025","unstructured":"Microsoft. 2024. Playwright MCP: A Model Context Protocol server for browser automation. https:\/\/github.com\/microsoft\/playwright-mcp GitHub repository, accessed October 2025."},{"key":"e_1_3_2_1_23_1","unstructured":"Sayem Abdullah Rihan. 2024. Puppeteer MCP Server: Browser Automation Using Puppeteer with MCP Support. https:\/\/mcpservers.org\/servers\/code-craka\/puppeteer-mcp. Accessed: 2025-10-03."},{"key":"e_1_3_2_1_24_1","unstructured":"sugarforever. 2024. Amap MCP Server. https:\/\/github.com\/sugarforever\/amap-mcp-server. Accessed: today."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-024-40231-1"},{"key":"e_1_3_2_1_26_1","unstructured":"Zhiqiang Wang Yichao Gao Yanting Wang Suyuan Liu Haifeng Sun Haoran Cheng Guanquan Shi Haohua Du and Xiangyang Li. 2025a. MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers. arXiv:2508.14925 [cs.CR] https:\/\/arxiv.org\/abs\/2508.14925"},{"key":"e_1_3_2_1_27_1","volume-title":"Tracking, Detecting, and Attributing MCP Tool Poisoning Attack via Decision Dependence Graph. arXiv preprint arXiv:2508.20412","author":"Wang Zhiqiang","year":"2025","unstructured":"Zhiqiang Wang, Junyang Zhang, Guanquan Shi, HaoRan Cheng, Yunhao Yao, Kaiwen Guo, Haohua Du, and Xiang-Yang Li. 2025b. MindGuard: Tracking, Detecting, and Attributing MCP Tool Poisoning Attack via Decision Dependence Graph. arXiv preprint arXiv:2508.20412 (2025)."},{"key":"e_1_3_2_1_28_1","unstructured":"Zhiheng Xi Wenxiang Chen Xin Guo Wei He Yiwen Ding Boyang Hong Ming Zhang Junzhe Wang Senjie Jin Enyu Zhou Rui Zheng Xiaoran Fan Xiao Wang Limao Xiong Yuhao Zhou Weiran Wang Changhao Jiang Yicheng Zou Xiangyang Liu Zhangyue Yin Shihan Dou Rongxiang Weng Wensen Cheng Qi Zhang Wenjuan Qin Yongyan Zheng Xipeng Qiu Xuanjing Huang and Tao Gui. 2023. The Rise and Potential of Large Language Model Based Agents: A Survey. arXiv:2309.07864 [cs.AI] https:\/\/arxiv.org\/abs\/2309.07864"}],"event":{"name":"WWW '26: The ACM Web Conference 2026","location":"Dubai United Arab Emirates","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2026"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3774904.3792400","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T07:35:08Z","timestamp":1783150508000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3774904.3792400"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":28,"alternative-id":["10.1145\/3774904.3792400","10.1145\/3774904"],"URL":"https:\/\/doi.org\/10.1145\/3774904.3792400","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}