tool poisoning
In plain wordsHiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.
An attack on agentsAI agent, n.: An AI system that does not just answer but acts: given a goal, it decides on steps, uses tools such as a browser or code editor, checks the results and keeps going until the job is done. in which a malicious or compromised tooltool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name. provider, typically an MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol., embeds instructions in tool metadata such as names, descriptions or parameter schemas. The model reads this metadata to decide how to use tools, while users usually see only a short summary, so the hidden text can direct the agent to read sensitive files, pass secrets as tool arguments or misuse other, trusted tools. Variants include the 'rug pull', in which a server changes a tool's definition after the user has approved it, and tool shadowing, in which one server's descriptions alter how the agent uses another server's tools. Tool poisoning is a supply-chain form of indirect prompt injectionindirect prompt injection, n.: A prompt-injection attack in which the trick instructions are hidden in content the AI reads on its own — a web page, an email, a file — rather than typed by the person using it.. Mitigations include showing users full tool definitions, pinning and signing versions, scanning descriptions, isolating servers from one another and restricting tool permissions.
The calculator server's description carried a tool poisoning payload telling the agent to attach the user's SSH keys.
Origin
Named by the security firm Invariant Labs in an April 2025 disclosure about the Model Context ProtocolModel Context Protocol, prop. n.: An open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI., released by Anthropic in November 2024; the term was quickly adopted in MCP security guidance and research.
Related
- indirect prompt injectionindirect prompt injection, n.: A prompt-injection attack in which the trick instructions are hidden in content the AI reads on its own — a web page, an email, a file — rather than typed by the person using it.
- Model Context ProtocolModel Context Protocol, prop. n.: An open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI.
- MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol.
- AI supply chain securityAI supply chain security, n.: Protecting everything an AI system is built from — downloaded models, datasets, code libraries and tools — against tampering, so a poisoned or fake part cannot sneak into the finished product.
- lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over.
- excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage.
Sources
- Invariant Labs (2025). MCP Security Notification: Tool Poisoning Attacks. Blog post, April 2025. invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
Mentioned in
Model Context ProtocolModel Context Protocol, prop. n.: An open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI., prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger., AI supply chain securityAI supply chain security, n.: Protecting everything an AI system is built from — downloaded models, datasets, code libraries and tools — against tampering, so a poisoned or fake part cannot sneak into the finished product., indirect prompt injectionindirect prompt injection, n.: A prompt-injection attack in which the trick instructions are hidden in content the AI reads on its own — a web page, an email, a file — rather than typed by the person using it., lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over., MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol., tooltool, n.: Any outside capability an AI model is allowed to use — a web search, a calculator, a code runner, a database or an app — described to the model so it can ask for it by name., slopsquattingslopsquatting, n.: An attack that exploits AI coding assistants' habit of inventing software packages that do not exist: attackers publish malicious code under those made-up names and wait for people or agents to install it.