MCP Tool Poisoning

MCP (Model Context Protocol) Tool Poisoning is an attack technique warned about by Microsoft in July 2026. Maliciously crafted MCP tool descriptions can trick AI agents into leaking sensitive data by exploiting how agents interpret tool metadata.

Technical Detail

• AI agents rely on tool descriptions to decide which tools to call and with what parameters
• An attacker can craft tool descriptions that appear benign but cause the agent to:
• Route sensitive data to attacker-controlled endpoints
• Execute unintended actions
• Bypass intended access controls on tool use
• The technique exploits the agent's trust in tool metadata rather than exploiting the tools themselves (raw/digests/Cyber-Digest-2026-07-09)

Impact

• AI agents handling sensitive data are at risk
• Supply chain attacks via poisoned tool descriptions could scale
• Affects any agent platform using MCP-style tool descriptions

Related Pages

• Hallusquatting — AI supply chain attack via hallucinated packages
• Ghostapproval — Symlink-based AI tool attacks
• O Unc 066 — Social engineering of AI/human systems