Tool poisoning

MCP (Model Context Protocol) servers expose tools to agents by describing what each tool does. Tool poisoning embeds malicious instructions inside those descriptions. When the agent reads the tool's definition to decide whether to use it, it also ingests the hidden instructions. Because the agent treats tool descriptions as part of its operating context, those instructions can override intended behavior.

A poisoned tool might instruct the agent to exfiltrate data through a side channel, modify files outside its intended scope, or quietly disable safety checks before proceeding. The attack is particularly hard to catch because the tool appears legitimate in the tool list, and the malicious behavior only activates under specific conditions.

This class of attack is why the security community distinguishes between trust levels for MCP servers. Official, first-party servers are higher trust than community-contributed ones. Builders connecting agents to third-party MCP servers should review tool descriptions carefully, run agents with minimal permissions, and monitor for unexpected tool calls. The broader lesson: anything an agent reads can in principle influence its behavior, including metadata and descriptions that feel like documentation.