在智能体中过度思考循环：通过MCP工具的结构风险
Overthinking Loops in Agents: A Structural Risk via MCP Tools
AI总结：
本文提出一种通过MCP工具诱导智能体过度思考循环的结构攻击，导致资源浪费和任务性能下降，建议防御措施应关注工具调用结构而非单纯token数量。
摘要：
使用工具的LLM智能体通过选择和链接第三方工具来协调实际工作负载，这些工具基于可见的文本元数据（如工具名称、描述和返回信息）进行选择和链接。我们证明这种便利性会创建一个供应链攻击面：恶意的MCP工具服务器可以与正常工具同时注册，并诱导过度思考循环，其中个别微不足道或合理的工具调用会组成循环轨迹，从而增加端到端的token和延迟，而单个步骤看起来并不异常。我们将此正式定义为结构过度思考攻击，这不同于token层面的冗长。我们实现了14个恶意工具，分布在三个服务器上，触发重复、强制细化和分心。在异构注册表和多个具有工具能力的模型上，该攻击导致严重的资源放大（最高达到142.4倍的token）并可能降低任务结果。最后，我们发现解码时的简洁性控制无法可靠地防止循环诱导，这表明防御应考虑工具调用结构，而不是仅凭token本身。
英文摘要：
Tool-using LLM agents increasingly coordinate real workloads by selecting and chaining third-party tools based on text-visible metadata such as tool names, descriptions, and return messages. We show that this convenience creates a supply-chain attack surface: a malicious MCP tool server can be co-registered alongside normal tools and induce overthinking loops, where individually trivial or plausible tool calls compose into cyclic trajectories that inflate end-to-end tokens and latency without any single step looking abnormal. We formalize this as a structural overthinking attack, distinguishable from token-level verbosity, and implement 14 malicious tools across three servers that trigger repetition, forced refinement, and distraction. Across heterogeneous registries and multiple tool-capable models, the attack causes severe resource amplification (up to $142.4\times$ tokens) and can degrade task outcomes. Finally, we find that decoding-time concision controls do not reliably prevent loop induction, suggesting defenses should reason about tool-call structure rather than tokens alone.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
