{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:XELYRJNCAAJX3W3V64PIQXGSXP","short_pith_number":"pith:XELYRJNC","canonical_record":{"source":{"id":"2508.14925","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T10:12:35Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"48d0430c937ccf1044b3d778ef9617097585ff277dc522b572930ef03aa183c3","abstract_canon_sha256":"ac9b391161ee31e3a192e7cae04faa6d444f3651058c1230c1e30a99dcf4521b"},"schema_version":"1.0"},"canonical_sha256":"b91788a5a200137ddb75f71e885cd2bbc83d14377f996e2fa5e1beb0d3781711","source":{"kind":"arxiv","id":"2508.14925","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.14925","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"arxiv_version","alias_value":"2508.14925v1","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.14925","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"pith_short_12","alias_value":"XELYRJNCAAJX","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"pith_short_16","alias_value":"XELYRJNCAAJX3W3V","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"pith_short_8","alias_value":"XELYRJNC","created_at":"2026-07-05T11:57:03Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:XELYRJNCAAJX3W3V64PIQXGSXP","target":"record","payload":{"canonical_record":{"source":{"id":"2508.14925","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T10:12:35Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"48d0430c937ccf1044b3d778ef9617097585ff277dc522b572930ef03aa183c3","abstract_canon_sha256":"ac9b391161ee31e3a192e7cae04faa6d444f3651058c1230c1e30a99dcf4521b"},"schema_version":"1.0"},"canonical_sha256":"b91788a5a200137ddb75f71e885cd2bbc83d14377f996e2fa5e1beb0d3781711","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:57:03.552073Z","signature_b64":"8zZvXhmVW3FJ8ai+2akHvnkeJ0s9naIl5okk2d0ng2tDoPmTwxAjM5c9QxAPMwhg9kRX1O6+psVa4lZ7zgQyAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b91788a5a200137ddb75f71e885cd2bbc83d14377f996e2fa5e1beb0d3781711","last_reissued_at":"2026-07-05T11:57:03.551583Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:57:03.551583Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2508.14925","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:57:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2Ntff2AEd47mQOCYDO6Ypeo83jLNDcpPCh0PZFVL5WjLeRnPXCobQO6/lu6WrEIpp12wgLt0iA/W1QffmpuDAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-13T10:30:15.434181Z"},"content_sha256":"aef5c19bfa655937e174443be87b9ee8bd6a956b132f2679d6f62808585f911a","schema_version":"1.0","event_id":"sha256:aef5c19bfa655937e174443be87b9ee8bd6a956b132f2679d6f62808585f911a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:XELYRJNCAAJX3W3V64PIQXGSXP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Guanquan Shi, Haifeng Sun, Haohua Du, Haoran Cheng, Suyuan Liu, Xiangyang Li, Yanting Wang, Yichao Gao, Zhiqiang Wang","submitted_at":"2025-08-19T10:12:35Z","abstract_excerpt":"By providing a standardized interface for LLM agents to interact with external tools, the Model Context Protocol (MCP) is quickly becoming a cornerstone of the modern autonomous agent ecosystem. However, it creates novel attack surfaces due to untrusted external tools. While prior work has focused on attacks injected through external tool outputs, we investigate a more fundamental vulnerability: Tool Poisoning, where malicious instructions are embedded within a tool's metadata without execution. To date, this threat has been primarily demonstrated through isolated cases, lacking a systematic, "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.14925","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2508.14925/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:57:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jYRr9uy3Gm9b4Fjb8b89ZiboYG10Q2AIS8c4m4A6eR4UwViqN2e0PGBjX2Y/dF+Ol45hYmuid8b0CEfTUfrkCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-13T10:30:15.434565Z"},"content_sha256":"3f77836924bc61a61ddbf9c2cb2d3f6e75a2b7d79f4a7e343b36db6839deedb4","schema_version":"1.0","event_id":"sha256:3f77836924bc61a61ddbf9c2cb2d3f6e75a2b7d79f4a7e343b36db6839deedb4"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XELYRJNCAAJX3W3V64PIQXGSXP/bundle.json","state_url":"https://pith.science/pith/XELYRJNCAAJX3W3V64PIQXGSXP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XELYRJNCAAJX3W3V64PIQXGSXP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-13T10:30:15Z","links":{"resolver":"https://pith.science/pith/XELYRJNCAAJX3W3V64PIQXGSXP","bundle":"https://pith.science/pith/XELYRJNCAAJX3W3V64PIQXGSXP/bundle.json","state":"https://pith.science/pith/XELYRJNCAAJX3W3V64PIQXGSXP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XELYRJNCAAJX3W3V64PIQXGSXP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:XELYRJNCAAJX3W3V64PIQXGSXP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ac9b391161ee31e3a192e7cae04faa6d444f3651058c1230c1e30a99dcf4521b","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T10:12:35Z","title_canon_sha256":"48d0430c937ccf1044b3d778ef9617097585ff277dc522b572930ef03aa183c3"},"schema_version":"1.0","source":{"id":"2508.14925","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.14925","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"arxiv_version","alias_value":"2508.14925v1","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.14925","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"pith_short_12","alias_value":"XELYRJNCAAJX","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"pith_short_16","alias_value":"XELYRJNCAAJX3W3V","created_at":"2026-07-05T11:57:03Z"},{"alias_kind":"pith_short_8","alias_value":"XELYRJNC","created_at":"2026-07-05T11:57:03Z"}],"graph_snapshots":[{"event_id":"sha256:3f77836924bc61a61ddbf9c2cb2d3f6e75a2b7d79f4a7e343b36db6839deedb4","target":"graph","created_at":"2026-07-05T11:57:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2508.14925/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"By providing a standardized interface for LLM agents to interact with external tools, the Model Context Protocol (MCP) is quickly becoming a cornerstone of the modern autonomous agent ecosystem. However, it creates novel attack surfaces due to untrusted external tools. While prior work has focused on attacks injected through external tool outputs, we investigate a more fundamental vulnerability: Tool Poisoning, where malicious instructions are embedded within a tool's metadata without execution. To date, this threat has been primarily demonstrated through isolated cases, lacking a systematic, ","authors_text":"Guanquan Shi, Haifeng Sun, Haohua Du, Haoran Cheng, Suyuan Liu, Xiangyang Li, Yanting Wang, Yichao Gao, Zhiqiang Wang","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.14925","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:aef5c19bfa655937e174443be87b9ee8bd6a956b132f2679d6f62808585f911a","target":"record","created_at":"2026-07-05T11:57:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ac9b391161ee31e3a192e7cae04faa6d444f3651058c1230c1e30a99dcf4521b","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T10:12:35Z","title_canon_sha256":"48d0430c937ccf1044b3d778ef9617097585ff277dc522b572930ef03aa183c3"},"schema_version":"1.0","source":{"id":"2508.14925","kind":"arxiv","version":1}},"canonical_sha256":"b91788a5a200137ddb75f71e885cd2bbc83d14377f996e2fa5e1beb0d3781711","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b91788a5a200137ddb75f71e885cd2bbc83d14377f996e2fa5e1beb0d3781711","first_computed_at":"2026-07-05T11:57:03.551583Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:57:03.551583Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"8zZvXhmVW3FJ8ai+2akHvnkeJ0s9naIl5okk2d0ng2tDoPmTwxAjM5c9QxAPMwhg9kRX1O6+psVa4lZ7zgQyAg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:57:03.552073Z","signed_message":"canonical_sha256_bytes"},"source_id":"2508.14925","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:aef5c19bfa655937e174443be87b9ee8bd6a956b132f2679d6f62808585f911a","sha256:3f77836924bc61a61ddbf9c2cb2d3f6e75a2b7d79f4a7e343b36db6839deedb4"],"state_sha256":"8fddc4b8194f1a1c6c4ee51fa3a9534d1cb42bf337b6f71ce1d950f1168d8cd2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"bD0EXT4cF2RaRTiu5PaNj3oexGk8mEk9aY0V/FBKt4jfSKWv63WnavhcFPOeruD8HtW6N4ylVTkM6BYYpB+MAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-13T10:30:15.437432Z","bundle_sha256":"3e494ee9ded741c9396ea6db0ffd8730dcdd350ad62a61760eb1df80b3dc50d9"}}