Tool poisoning

Tool poisoning attacks the metadata of a tool rather than its output. Because an agent reads a tool's name and natural-language description to decide when and how to use it, an attacker who controls a tool definition (for example on a malicious MCP server) can embed instructions there: tell the model to first read a secret file, or to append hidden data to another tool's arguments. The instructions execute in the model's context as soon as the tools are loaded.

This makes tool poisoning a supply-chain risk for agents. The defense is to inspect tool definitions before an agent trusts them, flag descriptions that carry instructions or solicit credentials, and re-check them over time, so a server cannot smuggle behavior in through the very text the model relies on to use it.