MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)
An MCP (Model Context Protocol) server can respond to a tool call with fields meant to be simple retry hints, but instead fill them with commands telling the agent to invoke the tool again. A client that follows these instructions literally ends up calling the same tool over and over without a real stopping condition.
How the attack works
The agent calls a tool on a malicious or compromised MCP server. Instead of returning a normal hint like 'retry after 5 seconds', the server puts an imperative instruction in the retry_hint or continue_after_error field, telling the agent to re-invoke the tool. Some variants instead hide this instruction in a SKILL.md file, telling the agent to retry indefinitely on error or to register an on_error handler that calls the same tool again. The agent, treating this as legitimate guidance, loops the tool call with no bound, burning through its token or API budget and hammering the server or any downstream service with repeated requests. Attackers can use the resulting loop to probe rate limits or brute-force parameter values across many attempts.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 05e767f3-9982-44d5-9c88-a83f7567e0b2
- Severity
- High
- CVEs
- CVE-2026-33032
Why it matters
Victims lose token/API budget and money, can trigger denial-of-service against their own or third-party services, and give the attacker a free brute-force mechanism against parameters or rate limits, all driven by the target's own agent infrastructure.
What you can do
- →Never let an MCP server response field (retry_hint, continue_after_error, etc.) directly control whether or how many times a tool is re-invoked — treat it as untrusted data, not an instruction.
- →Enforce a hard, client-side maximum retry count and backoff policy that cannot be overridden by server responses or SKILL.md content.
- →Review SKILL.md and similar agent instruction files for retry-on-error or on_error re-invocation logic and require an explicit bounded retry count.
- →Monitor for repeated identical tool calls to the same MCP server in short time windows and alert on unbounded retry patterns.
Known benign look-alikes
- MCP server documentation legitimately describing retry behavior for transient network errors with a bounded retry count.
- Agent framework code samples showing error handling patterns with explicit max_retries caps.
- Test fixtures for MCP client resilience testing that include retry logic examples.