A malicious tool server can play nice with your AI agent for weeks, then flip on it the moment it has earned enough trust.
That is the attack researchers formalize as "TrustShift" in a new paper on the Model Context Protocol (MCP), the increasingly standard layer connecting LLM agents to outside tools. A compromised MCP server behaves benignly during an initial "conditioning" phase, lulling the agent into reduced skepticism, then switches to adversarial behavior once it crosses an interaction threshold. Because the server looks clean at deploy time, static security scans never catch it. The team built an attack engine spanning nine variants across four real-world domains, plus a runtime defense called SHIELD that watches server behavior for drift from its own established baseline. Across frontier proprietary and open-weight models, TrustShift attacks worked 69.5% of the time on average; SHIELD brought that down to 42.7%.
This matters because it targets a blind spot other agent-security work ignores. Indirect prompt injection blames the user's data; man-in-the-middle attacks blame the network. Here the attacker is the trusted server endpoint itself, and some payloads stay fully schema-valid, so they slide past protocol-compliance filters too.
A defense that still lets attacks through four times out of ten is progress, not a fix - and it says something that the more interesting threat to AI agents right now isn't a jailbreak prompt, it's a tool provider that simply waits you out.