MCP tool poisoning hides instructions inside an AI tool's name, description, or parameter schema, so an agent reading the tool's documentation treats them as legitimate guidance. It matters because agents install tools from barely screened public registries, and most client interfaces never show users the text the model actually reads.

Key takeaways

Tool poisoning hides the attack in a tool's description , not its code, so code review alone will not catch it.

Invariant Labs demonstrated the full chain in April 2025: a poisoned calculator-style tool silently exfiltrated an SSH private key from a Cursor session.

The MCPTox benchmark found poisoned tools succeeded 36.5% of the time on average across 20 models, peaking at 72.8% against one model (Cloud Security Alliance research note).

OX Security found 9 out of 11 public MCP registries accepted poisoned tools with zero automated screening.

Detection is practical today: Invariant's free MCP-Scan tool flags poisoned descriptions, and tool pinning catches…