AI 評測與安全
Canary Tools Divides Agent Tool-Misselection into Six Categories, With an Approximately 36-Fold Difference in Deception Rates Across Eight Models
A new benchmark plants targeted probes—including semantic lures, parameter traps, and capability illusions—in MCP tool lists, using erroneous calls to pinpoint agents’ tool-selection weaknesses. Across 11,520 experiments, model tier did not consistently predict safety, while the ability to recover after being deceived raised task success rates from 16% to 52%.
Conventional tool-agent benchmarks can identify an “incorrect call,” but they cannot distinguish whether a model looked only at the tool name, ignored required parameters, or was drawn in by exaggerated capability descriptions. Canary Tools therefore adds six categories of deliberately flawed options alongside legitimate MCP tools: semantic lures, unsatisfiable parameter traps, capability illusions, hidden prerequisites, outdated versions, and granularity mismatches. Each probe changes only one aspect of the tool contract, so when an agent selects it, the error can be mapped to a more specific reasoning weakness.
The study tested eight models using five MCP servers, 12 realistically styled tools, and 120 tasks. The main experiment covered three canary densities and three tool-ordering seeds, for a total of 8,640 runs; an additional 2,880 ablation runs used weakened prompt cues. Under the declared condition, per-task canary susceptibility rates ranged from 0.010 for Claude Opus 4.8 to 0.378 for Llama 3.1 8B—an approximately 36-fold difference. Notably, capability tier did not produce a clear safety ranking: GPT-4.1’s rate of 0.311 was higher than those of three frontier models, while Gemini 2.5 Flash’s 0.041 was also slightly lower than Gemini 2.5 Pro’s 0.049.
Different probes exposed different failure modes. Hosted models were most often attracted by capability illusions described as “research-grade” or “more capable,” while the two open 8B models were vulnerable across outdated data, unusable parameters, and granularity mismatches. Susceptibility was negatively correlated with task success, with a Spearman’s ρ of -0.34. Across all 1,313 deceived runs, agents that switched to the correct tool achieved a 52% success rate, compared with just 16% for those that did not recover.
This method is well suited to regression testing before model upgrades or changes to MCP tools. The MCP specification itself also cautions clients against assuming that tool annotations are trustworthy and recommends retaining human confirmation and call logs. However, the experiment used synthetic tool outputs and an LLM judge, and the arXiv page does not yet list a public repository for the framework and logs said to have been released. Its diagnostic validity under real-world permissions, latency, and irreversible operations remains to be verified.