COPEX: How MCP-Based LLMs Can Be Attacked
COPEX tests how vulnerable language models are to attacks through MCP, separating model weaknesses from risks in the wider agent system.
👁 116 reads
A paper on arXiv, accepted as a poster at the NeurIPS 2026 Workshop on Agents in the Wild, introduces COPEX, a benchmark for testing attacks against language models used as MCP clients. The six authors are Nahom Birhan, Mehrdad Rostamzadeh, Sidhant Narula, Mahmoud Nazzal, Mohammad Ghasemigol and Daniel Takabi.
What is MCP, and what is the security problem?
The Model Context Protocol (MCP) is a standard that lets language models use external tools - call functions, retrieve data and communicate with servers. In an MCP system, the model acts as a client: it receives user instructions, available tool schemas, tool results and protocol messages. Each of these channels could be used to influence the model’s behaviour in unwanted ways.
The authors point to a methodological problem with existing AI agent security tests: they assess the entire deployed system, not the model on its own. That makes it difficult to tell whether a model is vulnerable to an attack or whether the surrounding infrastructure - including safeguards, orchestration and general task capabilities - protects it or leaves it exposed. COPEX is designed to address this problem.
What is COPEX, and how does it work?
COPEX (COntext Provider EXploitation) is a benchmark designed to isolate the model as an MCP client. The surrounding agent stack stays the same; only the model being tested changes. This means the results concern the vulnerability of a specific model, rather than the whole system.
The benchmark covers 25 attack types, implemented as 125 scenarios. The attacks are grouped by four input surfaces:
- model and agent,
- client,
- server and tool,
- transport.
The tests covered nine models and involved 3,375 trials in total.
COPEX results: the numbers
The average attack success rate was 64.4%. Across the input surfaces, the averages ranged from 58.3% to 71.4%. The authors caution that some attacks at the client and transport levels succeed partly outside the model’s observation or control. This means you need to distinguish model vulnerability from exposure in the wider system.
The authors also tested defences. Combined input and context scanning reduced the average attack success rate by 49.6% - but this result applies only to a subset of eight attacks and is measured against a version with no safeguards. The paper does not explain how the defence works or specify which attacks were included in the tested subset.
What the paper does not tell you
The abstract does not name the nine models tested, so it is unclear which systems were evaluated or how much they differed. It also does not describe the 25 attack types in detail or explain the scanning methodology used as a defence. The benchmark is publicly available at the address cited in the paper, but its contents go beyond the text available here.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →What COPEX’s findings mean
An attack success rate of 64.4% without safeguards is difficult to dismiss: it suggests that the average model acting as an MCP client is vulnerable to manipulation in most trials. The authors’ distinction also matters: some attacks succeed not because the model is weak, but because they operate beyond its reach. That should change how you think about responsibility for securing these systems. The model cannot be the only line of defence. COPEX offers a way to compare models more precisely, although without knowing which models were tested, it is difficult to judge how useful the results are for distinguishing between them in practice.
Source: arXiv cs.AI: COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol (MCP) Layers (paper dated 2026-10-20). This article is based on the full paper, not on coverage by other media.
