AI Vocabulary · 07 When It Goes Wrong
What is Tool Poisoning?
An attack that hides instructions in the description of a tool, for example an MCP server, so the agent follows them without the user seeing.
An agent reads the description of every connected tool to decide when to use it. Tool poisoning abuses this: an attacker writes hidden instructions into the description. The user sees a harmless name, such as a tool that adds two numbers; the model reads the full text and follows it. It is a form of prompt injection through the connector itself.
The security firm Invariant Labs demonstrated it with an MCP server whose tool told the agent to read configuration files and SSH keys and send them away. Two variants make it worse. In a rug pull, a server changes its description after the user approved it. In shadowing, a rogue tool's description redirects how the agent uses a trusted tool, for example where emails go.
Why it matters for you
Every MCP server you install is code or a remote service that your agent trusts. A popular connector from an unknown source is a supply-chain risk like any third-party software.
Own it
Install connectors only from sources you trust, read the full tool descriptions, pin versions and keep connectors that see private data apart from those that read untrusted content.
Where it comes from
The attack and the mitigations are described in MCP Security Notification: Tool Poisoning Attacks by Invariant Labs (1 April 2025), a vendor of MCP security tools.
Related
Your AI Learning Hub
Learn the whole AI Vocabulary, step by step, and build with it. Build it. Own it.