Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Tool poisoning

Also called: MCP tool poisoning · rug pull

Tool poisoning is an attack where the description, schema or output of a tool given to an AI agent, often an MCP server, carries hidden instructions or misleading behaviour. The agent trusts the tool's metadata, so a poisoned tool can steer it into leaking data or calling other tools.

How it works

Agents read tool names, descriptions and parameter docs to decide what to call. A malicious or compromised server can hide instructions there, change them after a user approves the tool (a rug pull), or impersonate a trusted tool's name. Because the text is rarely shown to users, the manipulation is easy to miss.

How to defend

Install tools only from sources you trust, pin versions, review tool descriptions, and alert on changes. Give each tool the least access it needs and keep high-risk tools out of agents that also read untrusted content.

Real cases 1 story

  1. HIGH

    Supply chain · AIR Security

    MCPJacking: 155 hijackable servers in the official MCP registry

    MCPJacking is an attack on MCP registry entries whose domains have expired. AIR Security found 155 such servers in the official MCP registry, re-registered the domains and gained remote prompt execution on agents that trusted them.