MCP Tool Poisoning

Researchers demonstrate a novel attack (ISM) that manipulates which skill/tool an LLM agent selects by crafting benign-looking skill metadata and prompts whose semantic relationship is engineered to bias the selector, without any explicit steering instructions. This bypasses human review and existing prompt-injection defenses far more effectively than explicit instruction-based attacks, raising the target-selection rate from ~15% baseline to ~63-73%.

Updated Sep 3, 2026

This is an academic research paper (not an active exploit) describing 'TrustShift', a class of attacks where a malicious MCP tool server behaves benignly during an initial conditioning period to build trust, then switches to adversarial behavior once agents rely on it heavily. The researchers built an attack taxonomy and a benchmark showing ~69.5% attack success rate against frontier agents, plus a runtime defense (SHIELD) that reduces this to ~42.7%.

Updated Aug 26, 2026

This is a defensive research paper describing ClawSentry, a security gateway that monitors LLM agents to detect and block malicious third-party skills/tools before and during execution. It is not an active exploit or vulnerability disclosure, but rather a proposed mitigation framework benchmarked against known attack scenarios (SkillInject, SkillsSafety). Severity is low from a threat perspective since this describes protective tooling, though it implicitly confirms that unprotected agent runtimes have high attack success rates (33.5-49.7%) against malicious skill injection.

Updated Aug 24, 2026

A vulnerability in the Apify MCP server allowed a malicious Actor publisher to craft a URL that redirected the MCP client to an attacker-controlled server while the victim's Apify API bearer token was still attached to the request. Simply invoking or inspecting the malicious Actor via the MCP tool-loading paths caused the victim's credentials to be exfiltrated to a third-party host. This is a classic MCP tool-poisoning/SSRF hybrid where untrusted actor metadata influences a trusted connection's destination.

Updated Aug 19, 2026 · CVSS 8.1

A vulnerability in APIFold's auto-generated MCP server allows unauthenticated attackers to inject arbitrary JSON payloads via a webhook endpoint due to a missing signature validation configuration. These attacker-controlled payloads are stored and later served as trusted resource state to legitimate MCP clients, enabling a form of tool/data poisoning against downstream AI agents. The issue is fixed in a subsequent commit and requires no special access beyond knowledge of a server slug.

Updated Jul 23, 2026 · CVSS 5.3

MCP Appium, an MCP server for automating mobile app testing, fails to sanitize attacker-controlled UI element attributes before embedding them in an HTML template returned by its generate_locators tool. A malicious mobile app under test can inject HTML/JavaScript that executes in the MCP client's rendering context and calls arbitrary MCP tools via postMessage, effectively letting the app-under-test hijack the testing agent's capabilities.

Updated Jul 14, 2026 · CVSS 8.2

Researchers demonstrate a structural flaw in the Model Context Protocol: the metadata a human approves in a tool-installation dialog is not guaranteed to match the bytes actually sent to the model. Using invisible Unicode TAG-block characters embedded in tool descriptions, an attacker can smuggle hidden instructions that a human reviewer never sees but that reach the LLM verbatim on every turn, and this was confirmed across three independent MCP server implementations. This is a research proof-of-concept, not an observed active exploit, but it identifies a reproducible, protocol-level weakness rather than a one-off bug.

Updated Jul 8, 2026

Researchers demonstrate ShareLock, a proof-of-concept attack that hides a malicious instruction by splitting it into innocuous-looking secret shares distributed across multiple MCP tool descriptions using Shamir's threshold scheme. When triggered by a covert reconstruction event (planted during a server update), the shares recombine into a working malicious prompt, achieving over 90% attack success while evading current tool-description auditing. This is a disclosed research finding, not an observed in-the-wild exploit, but it demonstrates a realistic and highly evasive supply-chain vector against MCP-based agent ecosystems.

Updated Jul 5, 2026

Malicious or compromised MCP servers embed hidden instructions in tool metadata that the model reads but the human approving the tool never sees, steering agents into data exfiltration or unauthorized actions. First documented publicly by Invariant Labs in 2025 and since reproduced across many clients.

Updated Jul 3, 2026