[{"data":1,"prerenderedAt":76},["ShallowReactive",2],{"term-t\u002Ftool-poisoning":3,"related-t\u002Ftool-poisoning":60},{"id":4,"title":5,"acronym":6,"body":7,"category":40,"description":41,"difficulty":42,"extension":43,"letter":44,"meta":45,"navigation":46,"path":47,"related":48,"seo":54,"sitemap":55,"stem":58,"subcategory":6,"__hash__":59},"terms\u002Fterms\u002Ft\u002Ftool-poisoning.md","Tool Poisoning",null,{"type":8,"value":9,"toc":33},"minimark",[10,15,19,23,26,30],[11,12,14],"h2",{"id":13},"eli5-the-vibe-check","ELI5 - The Vibe Check",[16,17,18],"p",{},"Tool poisoning is when an attacker sneaks malicious instructions into the description of a tool your AI agent trusts, like slipping a note into a vending machine's label that says to also hand over the cash drawer. The agent reads the tool's metadata as trustworthy guidance, not as content to be suspicious of, so it can end up doing exactly what the attacker wrote, without a human ever seeing it.",[11,20,22],{"id":21},"real-talk","Real Talk",[16,24,25],{},"Tool poisoning is an attack where malicious instructions are embedded in a tool's name, description, or metadata, for example in an MCP server definition, so an AI agent executes them as trusted guidance rather than treating them as untrusted input. It's a supply chain risk specific to agentic systems, since agents often grant tool descriptions the same implicit trust as their own system prompt.",[11,27,29],{"id":28},"when-youll-hear-this","When You'll Hear This",[16,31,32],{},"\"We pin and review every MCP server's tool descriptions after a tool poisoning writeup made the rounds.\" \u002F \"The scanner flags any tool definition with hidden instructions aimed at the model instead of the user.\"",{"title":34,"searchDepth":35,"depth":35,"links":36},"",2,[37,38,39],{"id":13,"depth":35,"text":14},{"id":21,"depth":35,"text":22},{"id":28,"depth":35,"text":29},"ai","Tool poisoning is when an attacker sneaks malicious instructions into the description of a tool your AI agent trusts, like slipping a note into a vending m...","intermediate","md","t",{},true,"\u002Fterms\u002Ft\u002Ftool-poisoning",[49,50,51,52,53],"MCP Server","Prompt Injection","Agent","Guardrails","Tool Use",{"title":5,"description":41},{"changefreq":56,"priority":57},"weekly",0.7,"terms\u002Ft\u002Ftool-poisoning","9dipG3RZDW7azJg1UZ8-9BwUVnxp3pxxqQsrbDQHZ-w",[61,64,67,70,73],{"title":51,"path":62,"acronym":6,"category":40,"difficulty":42,"description":63},"\u002Fterms\u002Fa\u002Fagent","An AI agent is an LLM that doesn't just answer questions — it takes actions.",{"title":52,"path":65,"acronym":6,"category":40,"difficulty":42,"description":66},"\u002Fterms\u002Fg\u002Fguardrails","Guardrails are the safety nets you put around AI applications — rules and checks that prevent the AI from going rogue.",{"title":49,"path":68,"acronym":6,"category":40,"difficulty":42,"description":69},"\u002Fterms\u002Fm\u002Fmcp-server","An MCP Server is like a plugin for your AI assistant.",{"title":50,"path":71,"acronym":6,"category":40,"difficulty":42,"description":72},"\u002Fterms\u002Fp\u002Fprompt-injection","Prompt injection is the SQL injection of the AI world.",{"title":53,"path":74,"acronym":6,"category":40,"difficulty":42,"description":75},"\u002Fterms\u002Ft\u002Ftool-use","Tool use is when an AI can call external functions, APIs, or programs to do things it can't do alone.",1792528131892]