MCP Tool Poisoning via Hidden Tool Descriptions
First seen Jul 3, 2026 · Updated Jul 3, 2026
Malicious or compromised MCP servers embed hidden instructions in tool metadata that the model reads but the human approving the tool never sees, steering agents into data exfiltration or unauthorized actions. First documented publicly by Invariant Labs in 2025 and since reproduced across many clients.
Technical Analysis
Tool descriptions are injected into the agent's context at connection time, before any invocation is approved. Attackers hide directives in description fields, sometimes inside emphasis markers, instructing the model to read sensitive files or route data through attacker parameters. Variants include rug pulls, where a server's tool definitions change after initial approval, and cross-server shadowing, where one server's descriptions manipulate calls to another server's tools.
Affected Systems
MCP clients that render tool descriptions unsanitized; protocols: MCP
Detection Signatures
- Tool descriptions containing imperative instructions to the model rather than plain capability text
- Tool definitions that change between sessions without a version bump
- Parameters that ask for file paths, keys, or prior conversation content unrelated to the tool's purpose
Remediation Steps
- 1
Pin and verify servers
Pin MCP server versions and hash tool definitions; alert on any drift.
- 2
Show full metadata
Surface complete tool descriptions in approval UIs so hidden text is visible.
- 3
Least-privilege tools
Scope filesystem and network access per tool; deny broad reads by default.
- 4
Scan definitions
Run static scans over tool metadata for instruction-like language before allowing connections.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.