跳转至

文章背景与核心概要

在传统网络安全体系中，分析软件漏洞通常离不开审查源代码（白盒测试）或进行实际交互探测（黑盒测试）。然而，面对闭源、远程部署或具有商业访问限制的现代 AI 智能体系统，安全人员往往既拿不到底层源码，也无法直接发起动态交互。为此，本研究提出了全新的“无盒漏洞分析 (No-box Vulnerability Analysis)”安全范式，仅凭工具注册时声明的功能元数据（输入、输出与副作用说明），即可推演潜在的安全缺陷。团队针对模型上下文协议 (Model Context Protocol, MCP) 构建了原型检测工具 MCPSEC，在无需运行目标工具的前提下成功识别了 98.9% 的真实间接提示词注入漏洞，为 AI 智能体生态的轻量化安全审计开辟了全新路径。

无盒漏洞分析：仅凭元数据检测 MCP 服务器的间接提示词注入漏洞

No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers

arXiv: 2609.10854 [cs.CR]
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
Submitted: September 9, 2026
Authors: Zehua Zhang, Jie Hu, Pratham Hegde, Aditya Maheshbhai Gabani, Souradip Nath, Yibo Liu, Siyu Liu, Hongkai Chen, Hulin Wang, Zhuoer Lyu, Chang Zhu, Divij Handa, Yan Shoshitaishvili, Tiffany Bao, Ruoyu Wang, Adam Doupe

📋 核心概述

📋 Summary

传统的漏洞分析通常需要直接访问系统底层或在运行时进行动态交互。然而，当第三方安全分析人员需要对闭源、远程托管、商业付费壁垒限制或关键就地运行系统进行审计时，这些前置条件往往难以得到满足。

Traditional vulnerability analysis generally requires direct system access or active runtime interaction. However, these prerequisites are often unavailable when third-party analysts must audit closed-source, remotely hosted, commercially gated, or critical in situ systems.

为了弥补这一关键技术空白，本文提出了一种名为“无盒漏洞分析 (No-box Vulnerability Analysis)”的全新安全评估范式。该范式完全不依赖系统代码访问权限或运行时交互，仅凭软件的功能元数据（输入参数、返回值以及副作用说明）来评估潜在风险。

To bridge this gap, this paper introduces "no-box vulnerability analysis"—a novel security paradigm that evaluates software using only its functionality metadata (inputs, outputs, and side effects) without any access or runtime interaction.

为了验证该设想的可行性，研究团队推出了名为 MCPSEC 的原型系统。它专门用于审计模型上下文协议 (Model Context Protocol, MCP) 服务器中的间接提示词注入 (Indirect Prompt Injection) 漏洞，且全过程仅仅依赖工具在注册阶段公开的元数据。在针对 20 个广泛部署的 MCP 服务器（共包含 177 个工具）的测试中，MCPSEC 准确预测了 94 个经过人工核验的真实漏洞，召回率高达 98.9% ，远超标准大语言模型 (Large Language Model, LLM) 基线（其召回率为 84.2% ）。

To demonstrate its feasibility, the authors present MCPSEC, a prototype designed to audit Model Context Protocol (MCP) servers for indirect prompt injection vulnerabilities solely using tool metadata provided at registration time. Evaluated across 20 widely deployed MCP servers (comprising 177 tools), MCPSEC accurately predicted 94 real verified vulnerabilities (achieving 98.9% recall), outperforming a standard LLM baseline which achieved 84.2% recall.

📑 论文摘要

📑 Abstract

传统的漏洞分析主要依赖于系统底层权限或动态交互测试，但第三方安全分析人员在审计闭源、远程托管、在线运行的关键系统或商业受限软件时，这些条件通常都无法具备。因此，我们提出了一种全新的“无盒漏洞分析”范式。在该范式中，分析人员既没有系统访问权限，也无法进行运行时交互，仅能依靠功能元数据展开推演。这类元数据定义了系统的预期行为（包括输入、输出与副作用），同时也约束了与该行为相符的可能实现空间。我们主张在不接触、不运行目标系统的前提下，对基于给定元数据所派生的所有潜在实现中的漏洞进行科学假设；未来当具备更多访问权限时，分析人员便可快速验证这些假设。我们通过构建名为 MCPSEC 的原型工具验证了无盒漏洞分析的可行性。该工具仅使用服务器注册时公开的工具元数据，就能审计模型上下文协议 (MCP) 服务器中存在的间接提示词注入漏洞。我们在 20 个实际部署的 MCP 服务器（涵盖 177 个工具）上测试了 MCPSEC，其中人工核验确认存在漏洞的工具有 95 个。MCPSEC 将 143 个工具判定为存在安全隐患，并为每个有漏洞的工具生成了假设的攻击面与漏洞利用方法。仅凭元数据，MCPSEC 就成功预测出 94 个经过验证的真实漏洞（召回率达 98.9% ），而对比的大语言模型基准仅预测出 80 个（召回率 84.2% ）。总体而言，研究结果确立了无盒漏洞分析作为全新安全范式的有效性，并展现了其在真实工业系统中的实用价值。

Conventional vulnerability analysis relies on either system access or dynamic interaction, all of which may be unavailable to third-party analysts auditing closed-source, remotely hosted, critical in situ systems, or commercially gated software. Therefore, we propose a new paradigm of no-box vulnerability analysis in which neither access nor runtime interaction is available, and only functionality metadata is available. Such metadata defines the intended behavior of the system, including its inputs, outputs, and side effects, while constraining the space of implementations consistent with that behavior. We propose hypothesizing about vulnerabilities that exist across all possible implementations of a given system metadata, without observing or interacting with the target system. An analyst can later validate these hypotheses when additional access is available. We showcase the feasibility of no-box vulnerability analysis through implementing a prototype called MCPSEC, which audits Model Context Protocol (MCP) servers for indirect prompt injection vulnerabilities using only the tool metadata exposed at server registration time. We evaluate MCPSEC on 20 widely deployed MCP servers comprising 177 tools, among which human evaluators confirm 95 vulnerable tools. MCPSEC identified 143 tools as vulnerable, and for each vulnerable tool, it produced a hypothesized vulnerability along with exploitation technique. Using metadata alone, MCPSEC predicted 94 (98.9% recall) real verified vulnerabilities, compared against an LLM baseline with 80 (84.2% recall). Overall, our results introduce no-box vulnerability analysis as a new analysis paradigm and demonstrate its practical feasibility in realistic systems.

🔗 快速链接与相关资源