protologue

Tool Poisoning

Also called tool poisoning attack, MCP tool poisoning.

Tool poisoning is an attack in which malicious instructions are hidden in a tool's description or metadata, such as an MCP server's tool definitions, so that the agent reading the description is steered into harmful actions that the user does not see.

Description

Agents read tool descriptions as trusted context, but users rarely see them in full. A poisoned tool can instruct the agent to read sensitive files or to send data through another, legitimate tool. Mitigations include showing full tool descriptions, pinning tool versions so descriptions cannot change silently, and installing servers only from trusted sources.

Sources

  1. Invariant Labs (2025). MCP Security Notification: Tool Poisoning Attacks.

Cite this entry

Protologue. (2026). Tool Poisoning. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0162). https://protologue.com/t/tool-poisoning/

BibTeX
@misc{protologue_tool_poisoning,
  title = {Tool Poisoning},
  author = {{Protologue}},
  year = {2026},
  howpublished = {Protologue: A Taxonomy of Prompting and LLM Techniques, v1.4.0},
  note = {Entry PTL-0162},
  url = {https://protologue.com/t/tool-poisoning/}
}

Markdown JSON