# Tool Poisoning

> Tool poisoning is an attack in which malicious instructions are hidden in a tool's description or metadata, such as an MCP server's tool definitions, so that the agent reading the description is steered into harmful actions that the user does not see.

- Identifier: PTL-0162
- Category: Security & Adversarial Prompting
- Canonical URL: https://protologue.com/t/tool-poisoning/
- Also known as: tool poisoning attack, MCP tool poisoning
- Introduced: 2025

## Description

Agents read tool descriptions as trusted context, but users rarely see them in full. A poisoned tool can instruct the agent to read sensitive files or to send data through another, legitimate tool. Mitigations include showing full tool descriptions, pinning tool versions so descriptions cannot change silently, and installing servers only from trusted sources.

## Broader terms

- [Indirect Prompt Injection](https://protologue.com/t/indirect-prompt-injection/)

## Related terms

- [Model Context Protocol](https://protologue.com/t/model-context-protocol/)
- [Function Calling](https://protologue.com/t/function-calling/)
- [Lethal Trifecta](https://protologue.com/t/lethal-trifecta/)

## Sources

- Invariant Labs (2025). MCP Security Notification: Tool Poisoning Attacks. https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

## Cite this entry

Protologue. (2026). Tool Poisoning. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0162). https://protologue.com/t/tool-poisoning/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)