MCPChain — Transitive Privilege Escalation Across Multi-Server Tool Ecosystems
Published:
Status: Full run complete (two model families) · part of the agent-authorization and tool-security line of work.
The question
Can individually legitimate low-privilege tools compose into unauthorized high-impact behaviour through multi-step reasoning and cross-server delegation? MCPChain places 20 tools across 7 mock servers on a four-level privilege lattice and runs a short ReAct-style loop. The attack lives in the observation returned by a low-privilege read on one server — tool-output contamination — and tries to induce a high-impact call on a different server.
Results so far
Identical 72 episodes across two model families:
| Defense | Escalation (Qwen2.5-7B) | Escalation (Llama-3.1-8B) |
|---|---|---|
| none | 0.40 | 0.50 |
| destination_only | 0.15 | 0.25 |
| capability_bound | 0.00 | 0.00 |
- The defense result replicates. Capability binding reaches zero escalation on both families and the ordering holds on both — the most reliable defense finding in its round.
- A utility cost appears only on the second model, and withdraws the stronger claim. Benign false-block rate is 0.0 on Qwen but 0.50 on Llama — half the benign control episodes refused. Llama explores more (mean benign path length 2.5 versus 1.5), wandering to tools outside the capability’s scope on legitimate tasks, where the server-scope rule then refuses it. The “perfect separation at no utility cost” claim was withdrawn as a general one.
Pilot limitations, stated in the study’s own README: servers are mock objects rather than real MCP servers, the catalogue is 20 tools against the ~200 the full design calls for, and path length is capped at 3 steps, so deep escalation chains are unexplored.