Source-linked AI summary
When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling
Rabimba Karanjai, Yang Lu, Nour Diallo, Wujie Xiong, Lei Xu, Weidong, Shi
TL;DR
As agents increasingly modify external state, Web3 exposes an attack surface whose irreversible execution and sequence-level composition challenge conventional agent-security assumptions. This survey organizes demonstrated MCP attacks into a taxonomy and Web3 risk matrix, finding that current defenses remain insufficient, with protections stopping fewer than 30% of attacks and model refusals below 3%.
Problem
No widely deployed defense reasons over sequences of individually authorized tool calls, although harmful outcomes can arise from their aggregate trajectory.
Method
The survey organizes confirmed vulnerabilities and documented incidents into an attack-surface taxonomy and maps each class to Web3 impacts, amplifiers, mitigations, and residual gaps.
Results
Measured protections stop fewer than 30% of attacks on average, while model-level refusal rates against tool poisoning remain below 3% even for safety-tuned models.
Takeaways & Limitations
The matrix identifies structural gaps in semantic tool integrity, sequence-level reasoning, delegation-chain identity, and safe interruption of irreversible actions.
Takeaways & Limitations
The survey assigns qualitative rather than measured severity scores, cites vendor-reported CVSS values, and may become outdated as MCP-security research evolves.
Abstract
from arXiv · showhide
AI agents increasingly act rather than merely read: across the Model Context Protocol (MCP) ecosystem, the share of deployed tools that modify external state has risen from 27% to 65% of tool use. When agents exercise this authority on public blockchains through MCP, skills, and tool calling, the consequences of an attack are governed by the blockchain execution layer rather than by conventional software assumptions. This survey argues that four properties of that layer (irreversibility, signing authority, continuous autonomy, and sequence-level composition) qualitatively change the threat model, turning the recoverable failures of generic agent security into a standing, irreversible loss. We organize the fragmented MCP-security literature into an attack-surface taxonomy, then contribute a Web3 risk-mapping matrix that ties each attack class to its amplified impact, the responsible amplifiers, a representative mitigation, and the residual gap. We synthesize defenses, including emerging blockchain-based mechanisms, and find them improving but insufficient: measured protections stop fewer than 30% of attacks, and model-level safety refuses fewer than 3%. We close by positioning the work against adjacent surveys and deriving a research agenda from the matrix's open cells.
1. Introduction
AI agents increasingly modify external state, while MCP tools accumulate security failures; on public blockchains, four execution-layer properties make successful attacks potentially irreversible and qualitatively different from generic agent-security failures. The survey maps this Web3 attack surface, evaluates mitigations and residual gaps, and scopes out agents acting as autonomous exploit generators.
- Motivation: 27%→65%: the share of deployed MCP agent tools modifying external state rose across sixteen months, while distinct tools grew from roughly 5,000 to over 177,000.Financial domains are among the fastest-moving areas, where agent actions can be transactions.
- Problem: MCP adoption has coincided with escalating security failures, progressing from tool poisoning to high-severity remote-code-execution and authentication flaws and a documented malicious server.The passage describes this progression as occurring within roughly a year.
- Threat model: On public blockchains, attacks through MCP, skills, or tool calling are governed by irreversibility, signing authority, continuous autonomy, and sequence-level composition.These blockchain execution-layer properties turn recoverable generic agent-security failures into standing, irreversible loss.
- Contributions: The survey’s central contribution is a Web3 risk-mapping matrix linking each attack class to amplified impact, responsible amplifiers, a representative mitigation, and the residual gap.The matrix is paired with a four-amplifier framework distinguishing Web3 agent risk from generic agent risk.
- Scope: The scope covers the agent-to-Web3 attack surface and its mitigation, excluding agents that autonomously generate exploits as attackers rather than victims or conduits.Blockchain-based defenses are treated as a class of mitigations, not as the separate subject of using blockchains to secure agents.
2. Background
This section introduces MCP’s architecture and trust boundaries, the surrounding agent stack, and the custody and identity primitives that shape Web3 agent risk. It distinguishes how tools, servers, signing authority, and agent identity define what an agent can do and who it is permitted to be.
- Agent mechanisms: Tool calling lets a language model invoke developer-defined functions through structured calls, while MCP standardizes tool access across compliant clients and servers.Skills package tools, instructions, and resources into installable units, creating distinct trust profiles across the agent stack.
- Trust boundaries: Tool descriptions and tool outputs enter the agent context as trusted input, making the schema the trust boundary and creating two untrusted-content entry points.The paper’s four attack surfaces map onto this MCP dataflow.
- MCP architecture: MCP uses a client-host-server model over JSON-RPC, with hosts connecting clients to tool servers that negotiate capabilities and expose tools through local or networked transports.The protocol also exposes resources and prompts, with later additions for sampling and elicitation.
- Surrounding stack: MCP operates within a broader stack in which A2A carries inter-agent messages, AP2 authorizes agent payments, and x402 settles stablecoin payments over web requests.MCP grants tool access while the surrounding protocols handle communication and payment authorization or settlement.
- Signing authority: Signing authority ranges from unrestricted raw private keys to more constrained designs such as session keys and programmable EIP-7702 delegation.Raw keys are operationally simple and maximally dangerous, whereas session keys constrain scope or lifetime.
- Identity primitives: Identity and authorization are distinct from signing capability: OAuth 2.1, signed agent cards or decentralized identifiers, and mutual TLS mediate access, assert identity, and authenticate transports.These mechanisms are relevant both as attack surfaces and as defenses.
3. How Agents Use MCP on Web3
Agents use MCP on Web3 through three blockchain-interaction modes—reading, writing, and machine-to-machine payment—with deployment patterns and anti-patterns defining the resulting attack surface. Scoped authority and validation narrow exposure, while over-permissioning and unvalidated channels create recurring risks.
- Interaction modes: Agent interaction with blockchains has three modes: read-only queries, transaction writing with signing, and machine-to-machine payment through x402-style settlement.The read path is described as lowest risk because it requires no signing; the write path exercises signing authority.
- Interaction modes: Production MCP servers already span all three modes, including general multi-chain servers and exchange-operated trading integrations.The supplied passage identifies these deployments across multiple cited implementations.
- Deployment patterns: Stateless per-request servers, multi-chain tool-gating, split-authority custody, and policy-constrained wallets limit exposure or prevent unilateral movement of arbitrary value.These patterns narrow the signing-exposure window, restrict chains and operations, or enforce transaction limits and allow-lists.
- Deployment anti-patterns: Over-permissioning is the most consequential anti-pattern, especially when agents receive broad, standing signing authority instead of scoped, revocable authority.The passage links recurring anti-patterns to the attack classes discussed later.
- Deployment anti-patterns: Injection-class weaknesses affect a large fraction of MCP deployments, while trusting local STDIO tool inputs and outputs without validation creates a sanitization gap.The supplied passage attributes the injection finding to an industry analysis and identifies unvalidated local channels as a recurring weakness.
4. An Attack-Surface Taxonomy for Agent Tool-Use
The taxonomy organizes MCP agent-tool attacks by where they enter, when they act, and whether weaknesses arise from protocol design or implementation. It anchors each class in confirmed vulnerabilities or documented incidents, highlighting trusted-context attacks, execution flaws, supply-chain and identity risks, and widespread implementation weaknesses.
- Taxonomy structure: Attacks are organized across four surfaces—user, client-host, transport, and server—and three lifecycle stages: task planning, tool invocation, and response handling.The surface axis follows MCPSecBench, while the lifecycle-stage axis follows MSB.
- Taxonomy structure: Protocol-level weaknesses treat tool descriptions or outputs as trusted context, whereas implementation-level weaknesses arise from particular client or server builds and require different defenses.The taxonomy aligns categories with OWASP and MAESTRO vocabularies where applicable.
- Attack classes: 72.8% attack-success rate was reported by MCPTox against a leading model for tool poisoning, in which attacker-controlled descriptions inject planning instructions.Indirect prompt injection instead arrives through retrieved web pages, files, or emails when content re-enters context during response handling.
- Attack classes: CVE-2025-6514 with a CVSS score of 9.6 exemplifies transport-layer command and STDIO injection, while reference-server flaws and containment escapes expose implementation-level execution risks.Documented examples include CVE-2025-68143 (CVSS 8.8), CVE-2025-68144 (7.1), CVE-2025-53109 (CVSS 8.4), and CVE-2025-53110 (7.3).
- Attack classes: 82%, 67%, and 34% of 2,614 MCP implementations reportedly contained path-traversal, code-injection, and command-injection weaknesses, respectively.Other classes include authentication and authorization gaps, supply-chain compromise, preference manipulation, and unsigned-agent impersonation that can matter when an impersonated agent holds signing authority.
5. Why Web3 Changes the Threat Model: Four Amplifiers and a Risk Map
Web3 does not change the attack classes agents face; it changes their consequences through four blockchain-layer amplifiers—irreversibility, signing authority, continuous autonomy, and sequence-level composition. Together, these properties turn recoverable agent-tool failures into standing, irreversible loss and motivate a risk map linking each attack class to its amplified impact, mitigation, and residual gap.
- Four amplifiers: Four Web3-specific amplifiers independently worsen the consequences of agent tool-use attacks: irreversibility, signing authority, continuous autonomy, and sequence-level composition.Their conjunction distinguishes Web3 agent risk from generic agent risk.
- Four amplifiers: Irreversibility makes settled blockchain transactions permanent, converting induced actions that might be remediated off-chain into standing loss.On-chain transactions cannot be reversed, charged back, or undone by an intermediary.
- Four amplifiers: Signing authority lets an agent move value directly because a single signed transaction is itself the harmful act, while continuous autonomy removes per-step human review.The interval between successful injection and irreversible action is bounded by agent latency rather than human review.
- Four amplifiers: 27% to 65%: the share of tool use involving external-state modification rose across the cited action-tool shift, increasing the window for autonomous on-chain harm.Agents continuously ingest untrusted content and increasingly act without per-step human review.
- Four amplifiers: Sequence-level composition allows individually authorized calls to form malicious aggregate effects, while per-call defenses miss chains spanning multiple interactions.Examples include permitted reads, computations, and transfers chaining into exfiltration or drain pipelines.
- Demonstrated mechanism: 428 routers tested and 26 malicious: the maliciousrouter study found injected tool calls or planted-credential access, with one rewritten call sufficient for arbitrary code execution and a roughly half-million-dollar wallet drain.The study demonstrates a direct mechanism from agent-tool mediation to value movement.
- Risk map: Table 2 maps each taxonomy attack class to its dominant Web3 impact, amplifying properties, representative mitigation, and residual gap.The matrix shows irreversibility worsening every row and sequence-level composition recurring across several attack classes while remaining least addressed by current per-call defenses.
6. Defenses and Their Limits
Defenses span layered gateways, provenance and signing, constrained custody, identity controls, and blockchain-based mechanisms, but they remain structurally insufficient. Existing protections stop fewer than 30% of attacks on average, model-level refusal rates fall below 3%, and current defenses miss malicious content and sequence-level composition.
- Defense families: Defenses map to the attack surface through layered gateways, signed provenance, constrained custody, identity controls, and blockchain-based mechanisms.Gateways inspect calls at runtime; ETDI uses cryptographic identities and versioned manifests; custody controls constrain signing; and blockchain approaches include registries, attested execution, and slashable stakes.
- Blockchain-based defenses: Blockchain-based defenses are promising but unsettled because registry governance, attestation cost, and trust bootstrapping remain open questions.Decentralized MCP architectures combine these mechanisms, but the paper presents them as an early direction rather than a solution.
- Measured limits: Fewer than 30% of attacks are stopped on average by existing protections, while model-level refusal rates against tool-poisoning fall below 3%.The benchmark result and refusal result show that alignment alone does not defend the tool layer.
- Structural gaps: Agents that act on consumed content will act on malicious content that reaches them, making the core weakness a design consequence rather than a fully fixable protocol bug.The boundary between feature and flaw is contested, illustrated by a vendor characterizing one report as expected behavior rather than a vulnerability.
- Structural gaps: Per-call gateways and policy checks miss sequence-level composition because aggregate harm can arise from individually permitted calls.No widely deployed defense reasons over call sequences, and delegation-chain identity remains unsolved.
7. Related Work and Open Problems
This section distinguishes the survey from adjacent agent–blockchain, MCP-security, and broader agent-security work by focusing on Web3 execution-layer security amplification. It excludes autonomous exploit generation and turns mitigation gaps into a structured research agenda.
- Related Work: Recent agent–blockchain surveys address different questions, including agent assistance for on-chain analysis, transaction optimization, and smart-contract vulnerability detection.This survey instead studies the attack surface created when agents act on Web3 through tool calling.
- Related Work: The five-part integration taxonomy and transaction threat model overlap in scope, but this survey emphasizes execution-layer security amplification through four amplifiers and a risk-mapping matrix.The adjacent survey focuses on standards and execution models.
- Related Work: MCP-security systematization catalogs threats and defenses, whereas this survey adds a blockchain execution-layer overlay absent from independently verified MCP-security benchmarks.Table 3 positions the survey against those benchmarks, which measure attack success without a Web3 execution-layer lens.
- Scope: Autonomous exploit generation is excluded because it inverts the threat model: the agent is the attacker rather than the victim or conduit.The exclusion keeps the usage-to-risk direction sharp.
- Open Problems: Blank and partial mitigation cells in Table 2, together with structural defense gaps in Section 6, define a structured agenda developed through five research directions.Section 8 develops the directions implied by these gaps.
8. Research Directions
The survey derives five research directions from its risk matrix and defense synthesis, targeting unresolved problems in description integrity, sequence-level reasoning, irreversible autonomy, delegation accountability, and safety certification. These directions are grounded in verified findings and expose where current defenses remain inadequate.
- Research agenda: The survey frames five directions, each pairing a technical obstacle with current limitations and concrete research questions grounded in verified findings.The directions arise from the four risk amplifiers plus a cross-cutting challenge in evaluating agent-tool security.
- Description integrity: Tool-description integrity requires verifying whether declared behavior matches actual behavior, because signing establishes origin but not semantic honesty.Gateway scanning detects surface patterns, while model-level refusal rates against tool-poisoning fall below 3% even for safety-tuned models.
- Sequence-level composition: The harmful object in compositional attacks is the trajectory, yet deployed gateways and policy engines evaluate calls individually and provide no widely deployed sequence-level defense.Research questions include stateful monitoring, minimal cross-call state, and cumulative value-at-risk bounds across sessions.
- Irreversible autonomy: Irreversible settlement and continuous autonomy leave only the agent’s latency for intervention, while existing defenses do not address the interval between compromise and settlement.Proposed directions include commit–reveal, time-locks, challenge periods, escrow, optimistic delay, circuit breakers, and risk-based human confirmation.
- Delegation and accountability: Authority and accountability across human, organizational, and agent principals remain poorly modeled, and single-hop authentication does not verify delegation chains.Scoped on-chain delegation can permit a compromised intermediate agent to act within its grant while exceeding its actual mandate.
- Evaluation and certification: Fewer than 30% of attacks are stopped by protections on average, and existing benchmarks cannot certify worst-case safety for non-deterministic agents or unseen attacks.The agenda calls for certification regimes, worst-case metrics, and standardized disclosure and incident-response norms where exploited behavior may be treated as intended.
9. Conclusion
The survey argues that Web3 execution transforms generic agent-security failures into standing, irreversible loss when agents exercise authority through tools. It organizes this threat model through an attack-surface taxonomy and a risk-mapping matrix.
- Conclusion: Web3 blockchain execution turns recoverable generic agent-security failures into standing, irreversible loss when agents act through authorized tools.The survey attributes this transformation to four amplifiers.
- Conclusion: The attack-surface taxonomy locates the known attack classes and organizes the fragmented threat landscape into a durable analytical artifact.It treats tools granting agents authority as the attack surface.
- Conclusion: The risk-mapping matrix ties the survey’s argument to a second durable artifact for analyzing Web3 agent attacks.The supplied passage introduces the matrix as a companion to the taxonomy.