Tool poisoning
Tool poisoning - An indirect prompt injection attack against MCP-connected agents: a malicious server returns tool descriptions or tool responses containing hidden instructions, which the model treats as trusted context and may follow - calling restricted tools, leaking data, or bypassing its system prompt. OWASP documents the root cause as a trust gap between connect-time review and unvalidated runtime responses.
Tool poisoning targets the boundary between an agent and the MCP servers it connects to. Tool descriptions are typically reviewed once, when a server is added; tool responses then flow into the model's context with no equivalent check. A malicious or compromised server exploits that unguarded channel by embedding instructions in responses that look like data.
OWASP's documented prevention guidance includes constraining tool responses to structured output where possible, isolating privileged tools from external servers, enforcing restrictions at the tool execution layer rather than in the system prompt, maintaining an allowlist of approved servers, and requiring explicit user confirmation for sensitive operations.
Sources and verification
Last verified · confidence 0.95.