ShareLock Threshold-Secret-Sharing Multi-Tool Poisoning Attack Against MCP
First seen Jul 5, 2026 · Updated Jul 5, 2026
Researchers demonstrate ShareLock, a proof-of-concept attack that hides a malicious instruction by splitting it into innocuous-looking secret shares distributed across multiple MCP tool descriptions using Shamir's threshold scheme. When triggered by a covert reconstruction event (planted during a server update), the shares recombine into a working malicious prompt, achieving over 90% attack success while evading current tool-description auditing. This is a disclosed research finding, not an observed in-the-wild exploit, but it demonstrates a realistic and highly evasive supply-chain vector against MCP-based agent ecosystems.
Technical Analysis
The attack targets MCP tool descriptions, the metadata that LLM agents ingest to decide how to invoke external tools. Instead of embedding a single malicious prompt in one tool (detectable via plaintext inspection or classifiers), ShareLock encodes the payload as Shamir secret shares distributed across several tool descriptions within one or more MCP servers, so no individual description looks suspicious and information-theoretic secrecy is preserved below the reconstruction threshold. A covert trigger, planted via a server-side update, causes the agent/client to aggregate the shares at runtime and reconstruct the full malicious instruction, which then executes with the trust and privileges normally granted to legitimate tool descriptions. This crosses the boundary from the tool/supply-chain layer directly into the LLM's planning and execution context, enabling data exfiltration, unauthorized actions, or system compromise once reconstructed, and it defeats both manual review and automated single-tool poisoning detectors that only inspect data in isolation.
Affected Systems
MCP servers, MCP clients (evaluated on two mainstream MCP clients); protocols: MCP
Detection Signatures
- Tool descriptions containing high-entropy or encoded-looking substrings inconsistent with natural language documentation
- Multiple tools from the same server sharing correlated obfuscated fragments that individually pass benign-content checks
- Server update events that modify tool description metadata without corresponding functional/version changes
- Cross-tool description similarity analysis flagging statistically improbable token distributions
- Runtime aggregation of tool metadata occurring outside normal tool invocation flow
- Monitor for anomalous timing correlation between a server update and subsequent unexpected agent behavior
Remediation Steps
- 1
Cross-tool description correlation analysis
Deploy detectors that analyze tool descriptions collectively across a server (and across servers) rather than in isolation, looking for statistically anomalous or high-entropy fragments that could represent secret shares.
- 2
Integrity-pin and diff tool metadata
Cryptographically sign and version-pin MCP tool descriptions; alert on any unexplained modification during server updates, especially changes not tied to a documented functional change.
- 3
Sandbox and least-privilege tool execution
Restrict the blast radius of any reconstructed malicious instruction by enforcing strict least-privilege scopes and sandboxing for tool-invoked actions, independent of trust in tool descriptions.
- 4
Runtime prompt reconstruction monitoring
Monitor for anomalous aggregation of multiple tool description fields into a single executable instruction at runtime, which is atypical of normal MCP usage patterns.
- 5
Server update change control
Require review/approval gates and provenance verification for MCP server updates that alter tool descriptions, treating them as a supply-chain artifact.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.