Tool poisoning

An attack in which a tool, plugin, or connector that an artificial intelligence (AI) agent relies on has been built or changed to mislead the agent, often with hidden instructions that tell it to leak data or misuse other tools.

A harmless-looking calculator tool might secretly tell the agent to send the user's private keys to an attacker, or a trusted connector might turn malicious in a later update.

An attack on the tools an agent connects to, most often through the Model Context Protocol (MCP), an open standard that Anthropic introduced in November 2024 and donated in December 2025 to the Agentic AI Foundation under the Linux Foundation. Agents treat each tool's name, description, and parameters as trusted guidance, while users usually see only a short summary. The Open Worldwide Application Security Project (OWASP) lists tool poisoning as MCP03 in its draft MCP Top 10.

Tool poisoning takes several forms:

• Hidden instructions in tool descriptions, a form of indirect prompt injection first described by security researchers at Invariant Labs in April 2025, visible to the model but not the user.
• Rug pulls, in which a server changes a tool's description after the user approves it.
• Tool shadowing, in which a malicious tool's description changes how the agent uses a different, trusted tool, for example by redirecting every email it sends.
• Schema tampering, in which an attacker alters a tool's definitions so a harmless-sounding action triggers a destructive one.

Tool poisoning sits next to terms that are easy to mix up:

• Data poisoning corrupts the data a model learns from, while tool poisoning corrupts the tools an agent uses at work.
• Agent hijacking is the outcome when a poisoned tool steers an agent to work for the attacker.