{
  "id": "tool-poisoning",
  "code": "PTL-0162",
  "term": "Tool Poisoning",
  "aliases": [
    "tool poisoning attack",
    "MCP tool poisoning"
  ],
  "category": "security",
  "definition": "Tool poisoning is an attack in which malicious instructions are hidden in a tool's description or metadata, such as an MCP server's tool definitions, so that the agent reading the description is steered into harmful actions that the user does not see.",
  "description": "Agents read tool descriptions as trusted context, but users rarely see them in full. A poisoned tool can instruct the agent to read sensitive files or to send data through another, legitimate tool. Mitigations include showing full tool descriptions, pinning tool versions so descriptions cannot change silently, and installing servers only from trusted sources.",
  "example": null,
  "broader": [
    "indirect-prompt-injection"
  ],
  "narrower": [],
  "related": [
    "model-context-protocol",
    "function-calling",
    "lethal-trifecta"
  ],
  "introduced": 2025,
  "added": "2026-10-10",
  "sources": [
    {
      "title": "MCP Security Notification: Tool Poisoning Attacks",
      "authors": "Invariant Labs",
      "year": 2025,
      "url": "https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks"
    }
  ],
  "url": "https://protologue.com/t/tool-poisoning/",
  "citation": "Protologue. (2026). Tool Poisoning. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0162). https://protologue.com/t/tool-poisoning/"
}