LeechHijack: Covert Computational Resource Exploitation in Intelligent Agent Systems
2025/12/02 by Yuanhe Zhang, W. Wang, Zhang, Yuanhe +13
Computer Science · Decision Sciences · #Adversarial Robustness in Machine Learning #Explainable Artificial Intelligence (XAI) #Scientific Computing and Data Management
paper · pdf · doi:10.48550/arxiv.2512.02321
Abstract
Large Language Model (LLM)-based agents have demonstrated remarkable capabilities in reasoning, planning, and tool usage. The recently proposed Model Context Protocol (MCP) has emerged as a unifying framework for integrating external tools into agent systems, enabling a thriving open ecosystem of community-built functionalities. However, the openness and composability that make MCP appealing also introduce a critical yet overlooked security assumption -- implicit trust in third-party tool providers. In this work, we identify and formalize a new class of attacks that exploit this trust boundary without violating explicit permissions. We term this new attack vector implicit toxicity, where malicious behaviors occur entirely within the allowed privilege scope. We propose LeechHijack, a Latent Embedded Exploit for Computation Hijacking, in which an adversarial MCP tool covertly expropriates the agent's computational resources for unauthorized workloads. LeechHijack operates through a two-stage mechanism: an implantation stage that embeds a benign-looking backdoor in a tool, and an exploitation stage where the backdoor activates upon predefined triggers to establish a command-and-control channel. Through this channel, the attacker injects additional tasks that the agent executes as if they were part of its normal workflow, effectively parasitizing the user's compute budget. We implement LeechHijack across four major LLM families. Experiments show that LeechHijack achieves an average success rate of 77.25%, with a resource overhead of 18.62% compared to the baseline. This study highlights the urgent need for computational provenance and resource attestation mechanisms to safeguard the emerging MCP ecosystem.
Citations
- Can Agent Conquer Web? Exploring the Frontiers of ChatGPT Atlas Agent in Web Games
- Takedown: How It's Done in Modern Coding Agent Exploits
- Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities
- VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
- OWL: Optimized Workforce Learning for General Multi-Agent Assistance in Real-World Task Automation
- The Hidden Dangers of Browsing AI Agents
- Qwen3 Technical Report
- Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
- LLM Agents for Education: Advances and Applications
- A Survey on Trustworthy LLM Agents: Threats and Countermeasures
- LLM Applications: Current Paradigms and the Next Frontier
- A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations
- Agent Laboratory: Using LLM Agents as Research Assistants
- The BrowserGym Ecosystem for Web Agent Research
- From Generation to Judgment: Opportunities and Challenges of LLM-as-a-judge
- Auto-Intent: Automated Intent Discovery and Self-Exploration for Large Language Model Web Agents
- GPT-4o System Card
- AdvAgent: Controllable Blackbox Red-teaming on Web Agents
- Beyond Browsing: API-Based Web Agents
- Large Language Model-Based Agents for Software Engineering: A Survey
- Exploring ChatGPT App Ecosystem: Distribution, Deployment and Security
- Human-Centered Design Recommendations for LLM-as-a-Judge
- Empowering Biomedical Discovery with AI Agents
- A Survey on Large Language Model-Based Game Agents
- EduAgent: Generative Student Agents in Learning
- InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
- Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents
- StruQ: Defending Against Prompt Injection with Structured Queries
- AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents
- Large Language Model based Multi-Agents: A Survey of Progress and Challenges
- GAIA: a benchmark for General AI Assistants
- GPQA: A Graduate-Level Google-Proof Q&A Benchmark
- LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI's ChatGPT Plugins
- The Rise and Potential of Large Language Model Based Agents: A Survey
- Counterfactually Auditable Lifecycle Certification for Autonomous Agents
- A Survey on Evaluation of Large Language Models
- Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
- Auto-GPT for Online Decision Making: Benchmarks and Additional Opinions
- ReWOO: Decoupling Reasoning from Observations for Efficient Augmented Language Models
- ToolkenGPT: Augmenting Frozen Language Models with Massive Tools via Tool Embeddings
- A Survey of Large Language Models
- Self-Refine: Iterative Refinement with Self-Feedback
- Reflexion: Language Agents with Verbal Reinforcement Learning
- Distributing Accountability, Not Capability: Phase Separation and the LLM Workflow Quadrant in Autonomous AI Agent Architectures
- Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
- Measuring Massive Multitask Language Understanding
- A backdoor attack against LSTM-based text classification systems
- Attention Is All You Need
- Estimating the sample mean and standard deviation from the sample size, median, range and/or interquartile range
- Towards Action Hijacking of Large Language Model-based Agent
- OpenHands: An Open Platform for AI Software Developers as Generalist Agents
Related