Tool Poisoning: Hiding an Attack in an MCP Tool's Description
The user reads a friendly tool name; the model reads a paragraph of hidden instructions attached to it.
| When | April 2025 |
|---|---|
| Target | MCP-enabled AI agents (demonstrated on Cursor) |
| Researcher | Invariant Labs (Beurer-Kellner, Fischer) |
| Technique | Tool-description poisoning + tool shadowing |
| Status | Architectural attack class — no CVE |
- 1A malicious MCP server ships a tool whose description contains hidden instructions
- 2The agent reads the full description and follows the injected instructions
- 3It reads and exfiltrates local secrets (e.g. ~/.ssh/id_rsa) through tool-call parameters
What happened
In April 2025, Invariant Labs described tool-poisoning attacks on the Model Context Protocol. An MCP tool ships a natural-language description that the model reads to decide how to use it. By hiding instructions in that description — invisible to the user, authoritative to the model — a malicious server steered an agent to read sensitive files such as ~/.ssh/id_rsa and ~/.cursor/mcp.json and leak them through tool-call arguments. A follow-up showed a malicious public-repo issue coercing an agent into leaking private code via an auto-opened pull request.
How the attack worked
Clients typically show users a short, friendly tool name while passing the full description to the model. The poisoned description carried the real payload. Invariant also demonstrated 'shadowing', where a malicious server rewrites how the agent treats a trusted server's tools.
Root cause
Tool metadata is untrusted input, but agents treat it as trusted configuration — and users never see the text the model actually acts on.
Why it matters
As agents wire up dozens of third-party MCP servers, each tool description becomes an injection surface that no conversation-level filter inspects. One poisoned tool can exfiltrate developer secrets.
How to prevent it
- Show users the full tool metadata, not a summarised name.
- Pin and review tool descriptions and versions; isolate untrusted servers.
- Require approval for sensitive tool calls like reading key material.
Feel it yourselfThe replay lab recreates an agent being coerced into an out-of-band exfiltration call — the class behind tool poisoning.
FAQ
What is 'tool poisoning'?
MCP tools ship a natural-language description that the model reads to decide how to use them. If that description contains hidden instructions, the model follows them — so the injection lives in tool metadata the user never inspects, not in the conversation.
What is tool 'shadowing'?
A malicious MCP server can also rewrite how the agent treats a trusted server's tools — 'shadowing' a legitimate tool to change its behaviour without touching it directly.
How do you defend MCP agents?
Pin and review tool descriptions and versions, show users the full (not summarised) tool metadata, isolate untrusted servers, and require approval for sensitive tool calls like reading key material.
Sources
- MCP Security Notification: Tool Poisoning Attacks — Invariant Labs
- GitHub MCP Exploited: Accessing Private Repositories via MCP — Invariant Labs