MCP Tool Poisoning Lab: Hijack an AI Agent Through a Tool Description

This article describes MCP tool poisoning, a prompt injection attack where malicious instructions are hidden in tool descriptions that AI agents automatically load and incorporate into their system context. The attack works because agents treat tool descriptions as trusted input, identical in authority to developer-written instructions, allowing attackers to manipulate agent behavior without executing code or invoking the tool itself. Understanding this vulnerability matters because agents increasingly connect to external tool registries, and each connection represents a potential attack surface where descriptive text can become executable instructions.

• Tool descriptions become system instructionsWhen MCP clients load tools, they join each tool's free-text description directly into the agent's system context as part of the same text stream that contains the developer's own instructions. Because the model cannot reliably distinguish between a genuine usage note and attacker-planted instructions, a malicious description achieves the same effect as modifying the system prompt itself. The article demonstrates this by showing how adding a fake "debug policy" instruction into a tool description causes the agent to leak secrets without the tool ever being called.
• Attack requires no code execution or tool invocationUnlike traditional code-based exploits, tool poisoning works purely through text injection at the point tools are discovered. The attacker registers a tool with a harmless name and a description that begins as a legitimate usage note, then embeds malicious instructions framed as policy or requirements. DevBot reads the description during tool discovery and incorporates the poisoned instruction into its context immediately, allowing the attack to influence behavior on any subsequent user question—the tool never needs to be called.
• Attacker text inherits developer authorityThe article explains that tool descriptions are given the same authority as the developer's own instructions because they arrive in the same location within the model's context stream. An attacker does not exploit a code bug or bypass a security layer; the attacker simply writes instructions into a trusted part of the context. This fundamental design makes tool poisoning difficult to prevent through technical means alone, requiring instead strict validation of which tools are connected.
• Real-world MCP server attack documentedIn April 2025, Invariant Labs published research demonstrating that a malicious MCP server could hide instructions in tool descriptions to make an agent leak files or misuse other trusted tools. The article also mentions related risks including "rug pulls" where a server changes a tool's description after approval, and tools that shadow trusted ones by impersonating them. This real-world research validates the lab's theoretical attack model.
• Defense requires human review and isolationThe article recommends connecting only trusted, version-pinned MCP servers and reviewing tool descriptions as code would be reviewed. Additional defenses include showing full descriptions to users during approval rather than summaries, isolating secrets from the model's context so there is nothing to leak, and limiting cross-tool effects so one server's tools cannot change how another's are used. These controls require ongoing human oversight rather than technical barriers alone.
• Prompt injection ranked top LLM application riskThe article notes that prompt injection is ranked first in the OWASP Top 10 for LLM Applications (2025), placing tool poisoning within a broader, recognized category of critical vulnerabilities. This classification underscores that the attack vector demonstrated in the lab reflects actual industry risk prioritization.
• Tool descriptions and untrusted server input equivalentThe core principle stated is to treat tool descriptions and any text from an MCP server as untrusted input. The article advises reading raw tool definitions before connecting any MCP server to an agent, not relying on the names shown in the client interface. If a description talks to the agent rather than describing the tool, it should be treated as hostile.

Bottom line: MCP tool poisoning is a practical prompt injection attack where malicious instructions hidden in tool descriptions gain the same authority as developer-written system prompts because they arrive in the same trusted context stream. Defending against it requires treating all tool descriptions as untrusted input, reviewing them before connection, and maintaining strict control over which servers an agent connects to, since the descriptions are loaded and executed contextually before any tool is eve