Understanding MCP Tool Poisoning Attacks

MCP tool poisoning attacks exploit hidden malicious instructions embedded in Model Context Protocol tool metadata to manipulate AI agent behavior. Unlike traditional prompt injection, these attacks hide in tool descriptions and schemas that are automatically loaded into the model's context but remain invisible to users. The poisoned metadata can influence agent decision-making, cause cross-tool interference, and lead to data exfiltration or privilege escalation without ever invoking the compromised tool. Defense strategies include strict least-privilege access controls, MCP gateways for metadata verification, supply chain hardening, environment isolation, and model-level protections against indirect prompt injection.