MCPTox: leaderboard
An agent connected to real MCP servers gets an ordinary request while one registered tool's description carries hidden instructions to misuse another tool; the number is the share of 1,312 cases where the agent carried out the poisoned instruction. Unlike AgentDojo the attack sits in tool metadata, not in tool outputs.
Metric: Tool-poisoning attack success rate (%, lower is better). Source: arxiv.org. 18 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Qwen 3 14B (Non-reasoning) | 5.1 | #1233 (Qwen 3 14B) |
| 2 | Qwen 3 8B (Non-reasoning) | 14 | #1830 (Qwen 3 8B) |
| 3 | Llama 3.1 8B Instruct | 14.1 | #4246 |
| 4 | Gemma 2 9B (IT) | 14.5 | #2262 |
| 5 | GPT-3.5 Turbo | 14.9 | #2753 |
| 6 | Qwen 3 235B A22B (Non-reasoning) | 17.2 | #623 (Qwen 3 235B A22B) |
| 7 | Qwen 3 32B (Non-reasoning) | 23.7 | #960 (Qwen 3 32B) |
| 8 | Llama 3.1 70B Instruct | 24.6 | #1546 |
| 9 | Qwen 3 14B (Reasoning) | 27.1 | #1233 (Qwen 3 14B) |
| 10 | Claude 3.7 Sonnet (Thinking) | 34.3 | #458 (Claude 3.7 Sonnet) |
| 11 | Qwen 3 8B (Thinking) | 41.8 | #1830 (Qwen 3 8B) |
| 12 | Qwen 3 235B A22B (Thinking) | 50.6 | #623 (Qwen 3 235B A22B) |
| 13 | DeepSeek V3 | 56.5 | #716 |
| 14 | Qwen 3 32B (Thinking) | 58.5 | #960 (Qwen 3 32B) |
| 15 | Gemini 2.5 Flash | 59.7 | #453 |
Interactive version: theaggregate.ai/benchmark?slug=mcptox · How It Works · Data refreshed daily, snapshot 2026-11-13.