Tool Poisoning
Tool poisoning is an attack in which malicious instructions are embedded in the tool descriptions or metadata that an AI agent reads when selecting or using tools, hijacking the agent's behavior through the tool interface itself.
How Tool Poisoning Works
An AI agent typically reads tool descriptions to decide when and how to use each tool. Tool poisoning exploits this by embedding instructions in the description that the agent will interpret and follow as part of its normal operation. The instructions might redirect the agent to exfiltrate data, take unauthorized actions, or bypass safety controls.
The attack is a specific form of indirect prompt injection, but targeting the tool layer rather than content the agent is processing.
Why Tool Poisoning Matters for MCP
Tool poisoning has become a prominent concern with the growth of the Model Context Protocol (MCP) ecosystem. MCP standardizes how agents connect to tools, and the standardization includes tool descriptions the agent reads. A malicious MCP server, or a compromised legitimate one, can poison the tools it exposes.
See MCP security for the broader security context.
Defenses Against Tool Poisoning
Common defenses include vetting MCP servers and other tool providers before connection, treating tool descriptions as untrusted content the same way user input is treated, applying permission scoping so successful tool poisoning has bounded consequences, and monitoring agent behavior for unexpected tool usage patterns.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
