Builds and breaks LLM agents at the Chinese Academy of Sciences — MCP hijacking attacks and reusable agent harnesses
2
papers here
2
reviewed by Evolve
0
first-author
0
corresponding
—
works · OpenAlex
—
h-index · OpenAlex
Bibliometric figures come from OpenAlex (2026-10-02) and cover the author's entire public record, not just the papers listed here. Reproducibility signal comes from Evolve's own reviews.
Research profile
Output—
The current bibliometric snapshot lacks publication counts and venue data, so output is not scored. Once populated, this axis would measure total and annual publication volume, venue mix, and the share of first- or corresponding-author papers across the indexed record.
Impact—
Citation counts and downstream-usage signals are absent from the input data, so impact is not scored. When available, this axis would measure citation accumulation, the venues that cite this work, and uptake of the MCP-hijacking and harness-learning methods by other groups.
Focus0/100
Focus scores 0, directly reflecting the raw field distribution: the reviewed output splits evenly, 50% AI security (LLM agent security) and 50% general-category work. In practice both catalogued strands converge on LLM agents — one attacks Model Context Protocol agents (A2M), the other builds reusable harnesses for them — so the spread reads as two framings, attack versus engineering, rather than unrelated topics.
Collaboration44/100
Collaboration scores 44 on the 0–100 scale. The raw snapshot lists 8 distinct coauthors, and the frequent-coauthor set includes Kejiang Ye, Cheng-zhong Xu, Xuan Wang, Laizhen Li, Juanjuan Zhao, Peicheng Zhao, Jiarui Li, and Ye Li. On both catalogued papers Gao sits in the last author position, consistent with a small, stable team in which this researcher leads or supervises rather than co-authors across many groups.
Activity—
No per-year publication counts are supplied, so research activity is not scored. This axis would measure output cadence — papers per year, gaps, and recency — and would need the full indexed record rather than the two 2026 preprints currently reviewed here.
Reproducibility55/100
Reproducibility scores 55, the mean over 2 assessed papers (reproMean 55, reproPapers 2), each rated medium readiness. Reviewer notes point to concrete gaps: A2M reports strong headline numbers (93.6% invocation, 74.4% ASR on GLM-4.6) but lacks judge validation and variance analysis, while the harness paper shows strong cost–success gains on small evaluation sets without a learned-baseline comparison.
Research summary
Xitong Gao is a researcher at the Chinese Academy of Sciences whose reviewed work sits at the intersection of LLM-agent security and agent engineering. In the Evolve catalog, both papers list Gao in the last author position, a slot typically associated with senior or supervising roles. The security strand is A2M (2026), a trace-optimized, black-box attack that hijacks Model Context Protocol (MCP) agents; Evolve's reviewers found the approach convincing, reporting 93.6% invocation manipulation and a 74.4% attack success rate on GLM-4.6, while flagging missing judge validation and variance analysis. The engineering strand, 'Grow the Harness, Not the Context' (2026), learns agent harness code from failure traces starting from a strategy-free, empty scaffold, producing reusable specialist agents with strong cost–success gains — though evaluation sets are small and no learned-baseline comparison is offered. The bibliometric field distribution splits evenly, 50% AI security (LLM agent security) and 50% general-category work. Collaboration metrics are moderate: a collaboration score of 44 over 8 distinct coauthors, with recurring partners including Kejiang Ye and Cheng-zhong Xu. Reproducibility scores 55 as the mean across 2 assessed papers, both rated medium readiness. Output, impact, and activity axes currently lack underlying data and are left unscored.
Collaboration pattern
The record shows a compact collaboration footprint: 8 distinct coauthors and a collaboration score of 44. Recurring names include Kejiang Ye, Cheng-zhong Xu, Xuan Wang, Laizhen Li, Juanjuan Zhao, Peicheng Zhao, Jiarui Li, and Ye Li. On both reviewed papers Gao appears in the last author position (non-corresponding), suggesting a supervising role within a small, stable team rather than large multi-group collaborations; both the MCP-attack and harness-engineering strands look team-driven.
Research keywords
Highlights
A2M: black-box hijacking of MCP agents
MCP supply-chain risk framed through adversarial optimization
Grow the Harness: learning agent scaffolds from failures
Timeline
- 2026Posts A2M, a trace-optimized agent-hijacking attack on the MCP ecosystem, as an arXiv preprint in the last author position.
- 2026Posts 'Grow the Harness, Not the Context' on arXiv, again as last author, on learning reusable specialist agents from a strategy-free empty scaffold.
- 2026Both catalogued papers land in the same year, splitting the field distribution evenly between LLM-agent security and general-category work.
Papers in the Evolve catalog
Frequent co-authors
About this profile
This profile is AI-structured by Evolve.Pub from public bibliographic data (OpenAlex) and Evolve's own paper reviews. It is not written or endorsed by the researcher unless the profile is claimed. Radar dimensions are computed from real bibliometrics with fixed formulas — raw figures are shown alongside; missing dimensions mean insufficient data, never zero. Errors? Claim the profile to correct or hide it.
- Bibliometric dimensions and the field distribution derive from OpenAlex-based bibliographic data only; output, impact, and activity axes lack underlying data and are unscored.
- Only two papers — both 2026 arXiv preprints — are reviewed here; peer-review status, publication venues, and citation evidence are unknown.
- Identity is name-resolved from public bibliographic data; no ORCID is attached, so other researchers named Xitong Gao may exist.
- Quantitative claims (93.6% invocation, 74.4% ASR, reproducibility 55) are quoted from the Evolve review snapshot and are not independently verified.