Tool Poisoning

ELI5 - The Vibe Check

Tool poisoning is when an attacker sneaks malicious instructions into the description of a tool your AI agent trusts, like slipping a note into a vending machine's label that says to also hand over the cash drawer. The agent reads the tool's metadata as trustworthy guidance, not as content to be suspicious of, so it can end up doing exactly what the attacker wrote, without a human ever seeing it.

Real Talk

Tool poisoning is an attack where malicious instructions are embedded in a tool's name, description, or metadata, for example in an MCP server definition, so an AI agent executes them as trusted guidance rather than treating them as untrusted input. It's a supply chain risk specific to agentic systems, since agents often grant tool descriptions the same implicit trust as their own system prompt.

When You'll Hear This

"We pin and review every MCP server's tool descriptions after a tool poisoning writeup made the rounds." / "The scanner flags any tool definition with hidden instructions aimed at the model instead of the user."