Murali Ediga

Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines

The Model Context Protocol (MCP) enables LLMs to invoke external tools, but every tool interaction exposes the model to attacker-controlled text through multiple input channels (tool descriptions, tool results, sampling messages) that share a single context window without privilege separation. In this paper, we present...