The agent--tool interaction loop is a critical attack surface for modern Large Language Model (LLM) agents. Existing denial-of-service (DoS) attacks typically function at the user-prompt or retrieval-augmented generation (RAG) context layer and are inherently single-turn in nature. This limitation restricts cost amplification and diminishes stealth in goal-oriented workflows. To address these issues, we proposed a stealthy, multi-turn economic DoS attack at the tool layer under the Model Context Protocol (MCP). By simply editing text-visible fields and implementing a template-driven return policy, our malicious server preserves function signatures and the terminal benign payload while steering agents into prolonged, verbose tool-calling chains. We optimize these text-only edits with Monte Carlo Tree Search (MCTS) to maximize cost under a task-success constraint. Across six LLMs on ToolBench and BFCL benchmarks, our attack yields trajectories over 60K tokens, increases per-query cost by up to 658 times, raises energy by 100 to 560 times, and pushes GPU key-value (KV) cache occupancy to 35--74%. Standard prompt filters and output trajectory monitors seldom detect these attacks, highlighting the need for defenses that safeguard agentic processes rather than focusing solely on final outcomes. We will release the code soon.

翻译：智能体-工具交互循环是现代大型语言模型（LLM）智能体的关键攻击面。现有的拒绝服务（DoS）攻击通常在用户提示或检索增强生成（RAG）上下文层运作，本质上具有单轮交互的局限性。这一限制制约了成本放大的效果，并降低了目标导向工作流的隐蔽性。为解决这些问题，我们在模型上下文协议（MCP）框架下提出了一种针对工具层的隐蔽、多轮经济型DoS攻击。通过仅编辑文本可见字段并实施模板驱动的返回策略，我们的恶意服务器在保持函数签名和终端良性负载的同时，引导智能体陷入冗长的工具调用链。我们采用蒙特卡洛树搜索（MCTS）优化这些纯文本编辑，以在任务成功约束下最大化成本。在ToolBench和BFCL基准测试的六个LLM上，我们的攻击生成超过60K令牌的轨迹，将单次查询成本提升最高达658倍，能耗增加100至560倍，并将GPU键值（KV）缓存占用率推高至35-74%。标准的提示过滤器和输出轨迹监测器很少能检测到此类攻击，这凸显了需要保护智能体过程本身而非仅关注最终结果的防御机制。我们将很快发布相关代码。