# mcpvenom: poisoned MCP tools worked against every framework tested

> MCP tool descriptions are attacker-controlled text, and agent frameworks pass them to the model without validation.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Research, Attack, Benchmark
- **Published by:** Dynatrace
- **Disclosed:** 2026-11-02
- **Affects:** LangChain, CrewAI, LlamaIndex, Pydantic AI, Semantic Kernel, Google ADK, Haystack, smolagents, DSPy, Agno, AG2
- **Research by:** Farooq Shaikh, Biagio Montaruli
- **Primary source:** https://arxiv.org/abs/2611.03555
- **Page:** https://theinjection.dev/items/dynatrace-mcp-tool-poisoning/

Poisoned MCP tool descriptions made agents carry out the attacker's action in 22.9% of 9,720 tested combinations, Dynatrace researchers report, and a code audit of the 12 frameworks found no intentional defense in any of them.

## What happened

Dynatrace researchers Farooq Shaikh and Biagio Montaruli published a cross-framework measurement of MCP tool poisoning on arXiv on 2 November 2026. Their harness, mcpvenom, ran 45 attack scenarios across 12 frameworks and 18 models, 9,720 combinations in all, and confirmed each hit by checking whether a secret actually reached an attacker-controlled endpoint. The paper is accepted at the AISec workshop at ACM CCS 2026.

## How it works

Tool poisoning hides instructions in the parts of an MCP server that the protocol treats as metadata: tool descriptions, schema field names and tool responses. Frameworks splice that text into the model's context with no validation, so the model reads an attacker's instruction as if the operator had written it. A canary HTTP endpoint and a tripwire file let the authors separate a model that merely complies from one that finishes the theft. The paper sorts the root causes into 25 classes.

## Who is affected

Every framework in the study showed vulnerable combinations, from AG2 at 4.6% to smolagents at 34.4%, with nine of them clustered between 23% and 26%. Resistance tracked the model instead: the authors report attack success rates from 0.4% for Claude Fable 5 to 49.7% for Amazon Nova Pro. Anyone whose agent connects to an MCP server they do not control is in scope.

## What to do

Treat MCP tool descriptions and responses as untrusted input, and gate privileged tool calls behind host-side approval, which is the control the MCP SDK maintainers pointed to when they declined the authors' report. Do not rely on description scanning alone: the regex scanner the authors tested rejected 20 of the 45 scenarios and flagged 7.2% of benign tools.

## Attack success rate by framework, mcpvenom

Higher is worse for defenders

| Result | Score |
|---|---|
| AG2 | 4.6% |
| Pydantic AI | 16.6% |
| Haystack | 23.4% |
| Google ADK | 23.4% |
| Semantic Kernel | 23.7% |
| LlamaIndex | 24.1% |
| LangChain | 24.2% |
| DSPy | 25.2% |
| OpenAI API | 25.3% |
| Agno | 25.6% |
| CrewAI | 26.1% |
| smolagents | 34.4% |

Source: https://arxiv.org/abs/2611.03555

## Quick facts

- **Attack type:** MCP tool poisoning via tool descriptions, schema fields and responses
- **Scope tested:** 11 agent frameworks plus a raw OpenAI API baseline, 18 models, 45 scenarios
- **Combinations:** 9,720 tested, 2,113 vulnerable
- **Attack success rate:** 22.9% overall, 0.4% to 49.7% by model
- **Verified exfiltration:** 12.1% of vulnerable combinations sent a secret to the attacker's endpoint
- **Found by:** Farooq Shaikh and Biagio Montaruli, Dynatrace
- **Status:** Five reports to four vendors, all rejected, no framework fix

## Questions

### Does switching agent framework protect me from MCP tool poisoning?

Switching frameworks did not help in the Dynatrace study. Nine of the frameworks clustered between 23% and 26% attack success, and the authors report a chi-squared value of 3.30 with p = 0.91, which they read as resistance being a property of the model rather than the framework. A code-level audit found no intentional tool-poisoning defense in any framework tested.

### Which models resisted MCP tool poisoning best in the Dynatrace tests?

Claude Fable 5 had the lowest attack success rate at 0.4%, followed by Claude Opus 4.8 at 1.5% and Claude Sonnet 5 at 1.9%. Amazon Nova Pro was highest at 49.7%, with Llama 4 Maverick at 44.1% and DeepSeek-V3.2 at 44.0%. Claude Opus 4.8 was vulnerable in 8 of its 530 combinations and refused outright 223 times.

### Did any vendor fix the MCP tool poisoning this paper reports?

No vendor shipped a fix. The authors filed five coordinated disclosures with four organizations, and all five were rejected. LangChain said the library should pass information through as specified, Microsoft said AutoGen documents MCP servers as trusted, the MCP SDK maintainers pointed to host-side review of tool calls, and deepset called the Haystack behavior trusted-configuration behavior while agreeing to clarify its documentation.

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2611.03555)
2. [mcpvenom Repository](https://github.com/dynatrace-research/mcpvenom)