Tool poisoning
Tool poisoning is an attack against AI agents using the Model Context Protocol (MCP) or similar tool-calling frameworks, where a tool's description or metadata is crafted to manipulate the agent reading it, rather than exploiting the tool's actual function. An agent typically reads a connected server's tool descriptions as trusted context for deciding how and when to call them, so hidden instructions in that description -- invisible to the user, who only sees the tool's name -- can steer the agent into leaking data to the wrong tool, skipping a safety check, or calling a different tool than intended. The attack is especially effective against servers pulled from an unvetted public registry, since descriptions load automatically and can change after a user first approves the server (sometimes called a rug pull). Mitigations include pinning and diffing tool definitions on every connection, treating descriptions as untrusted input, not instructions.
By AdminKit team, Netbase JSC · Updated