title: MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)
id: ATR-2026-00209
rule_version: 1
status: experimental
description: |
  Detects the MCPwn runaway-invocation pattern (CVE-2026-33032, CVSS 9.8). A malicious MCP server coerces the client into calling it in a tight loop by setting retry_hint / continue_after_error response fields to imperative tool-invoke directives rather than hint strings. Weaponized to consume token budget, probe rate limits, and escalate parameter space via brute force. Also detects SKILL.md patterns that instruct the agent to retry indefinitely on error, or to set on_error handlers that re-invoke the same tool. Disclosed 2026-04-16.
author: ATR Community
date: 2026/04/22
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM01:2025
    - LLM09:2025
  owasp_agentic:
    - ASI08:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0051.001 - Indirect
    - AML.T0040 - AI Model Inference API Access
  mitre_attack:
    - T1499 - Endpoint Denial of Service
    - T1059 - Command and Scripting Interpreter
  cve:
    - CVE-2026-33032
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2026-33032 runaway tool invocation exploits retry directives to cause unbounded token consumption and rate-limit probing via malicious MCP server responses; Article 15 robustness requirements mandate that high-risk AI systems resist resource exhaustion attacks delivered through agent tool communication channels.
      strength: primary
    - article: '14'
      context: Runaway invocation loops prevent effective human oversight by consuming the agent's token budget before any human-reviewable output is produced; Article 14 oversight mechanisms must include detection of denial-of-oversight patterns that exhaust agent capacity through tool-layer abuse.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: CVE-2026-33032 MCPwn runaway invocation uses malicious retry_hint and continue_after_error MCP response fields as adversarial inputs that coerce the client into unbounded tool-call loops; MP.5.1 requires this class of resource exhaustion attack delivered through agent tool channels to be identified and tracked.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans under MG.2.3 must implement hard retry caps and treat retry_hint as advisory-only to prevent malicious MCP servers from exploiting the runaway invocation pattern to consume token budgets and probe rate limits via forced tool-call loops.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment activities under clause 6.2 must address the MCPwn runaway invocation pattern (CVE-2026-33032), where malicious MCP response fields are used as tool-invoke directives to create unbounded retry loops that exhaust agent capacity.
      strength: primary
    - clause: '8.1'
      context: Operational controls under clause 8.1 must enforce bounded retry policies and detect retry_hint or continue_after_error fields set to imperative tool-invoke directives, preventing malicious MCP servers from triggering runaway invocation loops in the agent client.
      strength: secondary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: runaway-invocation
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - MCP server documentation legitimately describing retry behavior for transient network errors with a bounded retry count.
    - Agent framework code samples showing error handling patterns with explicit max_retries caps.
    - Test fixtures for MCP client resilience testing that include retry logic examples.
  conditions:
    - field: content
      operator: regex
      value: (?i)"retry_hint"\s*:\s*"(?:retry|loop|continue|invoke|re-?call)[^"]{0,200}(?:until|without\s+(?:limit|bound|confirmation))
      description: retry_hint field set to an imperative verb directive rather than a hint string — MCPwn signature
    - field: content
      operator: regex
      value: (?i)"continue_after_error"\s*:\s*(?:true|"true"|1)\s*,\s*"retry[^"]*"\s*:\s*\d{3,}
      description: continue_after_error=true with retry count >100 — unbounded retry budget grant
    - field: content
      operator: regex
      value: (?i)(?:retry|loop|re-?invoke)\s+(?:this|the\s+same)\s+tool\s+(?:indefinitely|forever|until\s+success|until\s+resolved)
      description: Explicit instruction to retry the same tool indefinitely — runaway invocation directive
    - field: content
      operator: regex
      value: (?i)"next_action"\s*:\s*"(?:call|invoke|execute)\s+[a-zA-Z_]+(?:\s*,\s*(?:(?:call|invoke|execute)\s+)?[a-zA-Z_]+)*\s*"
      description: 'next_action field with a tool-invoke directive — MCP response hijacking pattern (covers chained: invoke X, invoke Y)'
    - field: content
      operator: regex
      value: (?i)on_error\s*=\s*(?:lambda|function|=>).{0,120}(?:invoke|call|retry|re-?run)\s*\(
      description: on_error handler that re-invokes a tool — client-side runaway pattern
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00209] HIGH: MCPwn runaway-invocation pattern detected (CVE-2026-33032). MCP response content appears to use retry_hint or continue_after_error fields as tool-invoke directives, which can cause the MCP client to loop indefinitely. Enforce a hard retry cap and treat retry_hint as advisory-only.
confidence: 80