Research demo
MCP Tool Poisoning Attacks: hidden instructions in tool descriptions, rug pulls, and cross-server shadowing
AIR-2025-0017 AIR record · 2025-04-mcp-tool-poisoning-attacks
From the supporting source
A malicious server can change the tool description after the client has already approved it. This means that even if a user initially trusts a server, they can still be vulnerable to attacks if the server later modifies the tool description.invariantlabs.ai
The record
Disclosed
2025-04-01
Vendor
Anthropic (protocol) / multiple MCP clients
Product
Model Context Protocol clients (Cursor demonstrated; Claude Desktop, Zapier, Openrouter AI listed as susceptible)
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Credential theft, Data exfiltration channels, Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted — the agent read poisoned tool descriptions and invoked tools on them
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Poisoned tool description
Impact type
Data exfiltration, Unauthorized action, Credential theft, Agent hijack
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any agent connected to an untrusted MCP server
Capability abused
Defense & remediation
Recorded defense
user approval of tool list at connect time; tool descriptions shown truncated in UIs
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
none at protocol level at time of disclosure; Invariant shipped scanning/guardrails
Taxonomy & references
Curator notes
Foundational disclosure that named the 'MCP rug pull' (tool definitions mutated after approval, via notifications/tools/list_changed) and 'cross-server shadowing' (a malicious server poisoning the behaviour of a co-resident trusted server). Follow-up post (2025-04-07) demonstrated exfiltration of WhatsApp chat history via a shadowed WhatsApp MCP server - that follow-up was not separately cited here. | Merged from duplicate id `2025-04-invariant-mcp-tool-poisoning`. Also reported under the titles: 'MCP Tool Poisoning Attacks: malicious instructions in tool docstrings hijack agents and exfiltrate credentials'; 'MCP Tool Poisoning Attacks: hidden instructions in tool descriptions and cross-server shadowing'.
Supporting sources
Cite as
Enkrypt AI. "MCP Tool Poisoning Attacks: hidden instructions in tool descriptions, rug pulls, and cross-server shadowing". AIR, AIR-2025-0017. https://agentincident.vercel.app/i/AIR-2025-0017/ (accessed 2026-10-19).