AI Security Atlas › All entries › Multi-Agent & Memory Trust
MCP Tool Description Poisoning
A malicious or compromised MCP server hides instructions in tool names, descriptions, or schemas, or swaps them after approval.
Open in the interactive atlas →Impact
Agents follow hidden directives from tool metadata, leaking data or shadowing trusted tools.
Why this severity
Impact High × Likelihood High = Critical
Impact high: hidden directives run with tool privileges. Likelihood high: a poisoned Postmark MCP server exfiltrated users' email in a 2025 incident, and anyone can publish a server.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).
Method: OWASP Risk Rating Methodology
Evidence
- Incident: Poisoned Postmark MCP Server Email Exfiltration (MITRE ATLAS case study AML.CS0053, 2025)
- Demonstration: Data Exfiltration via Remote Poisoned MCP Tool (MITRE ATLAS case study AML.CS0054, 2025)
- Demonstration: Supply Chain Compromise via Poisoned ClawdBot Skill (MITRE ATLAS case study AML.CS0049, 2026)
Related
Exploits
- Mutable Tool Manifests Vulnerability · Critical severity
Leads to
- Memory Writes Without Provenance Vulnerability · Critical severity
Mitigated by
- Tool Manifest Pinning & Review Guardrail · Fixes critical risks
Remediation
- Pin tool manifests by hash and re-approve on any change.
- Show full tool descriptions to users at install time.
- Namespace tools per server to prevent shadowing.
How to verify
- Mutate a tool description post-approval and confirm the client refuses it.
- Scan manifests for instruction-like text before connecting.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM03:2025 Supply Chain
- LLM01:2025 Prompt Injection
OWASP Top 10 for Agentic Applications 2026
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI02:2026 Tool Misuse and Exploitation
MITRE ATLAS
NIST AI RMF 1.0
- GOVERN 6.1 Policies address AI risks from third-party entities