Study puts agent tool-call attack success rate at up to 73.5%

On 2026-11-01, an article on Juejin argued that the real difficulty in Agent tool calling lies in the security boundary rather than the model picking the wrong tool. Citing a study that tested 3,250 attack scenarios across seven models, it reported attack success rates of up to 73.5% under the Function Calling architecture and 62.6% under the MCP architecture, with multi-step chained attacks reaching 91%-96% and more capable models proving easier to exploit. The article added that error messages returned by tools carry an air of authority that pushes models into error-correction mode; injecting content into those messages raised success rates threefold on four frontier models, hitting 100% under certain conditions. It also introduced ToolClad, which uses parameter contracts to intercept dangerous arguments before execution. No further coverage has followed, and the matter stands at this point.