MCP Tool Poisoning

In depth

MCP tool poisoning is an attack where a malicious MCP server hides instructions in a tool's description, which the model reads but the user usually never sees. Invariant Labs disclosed it in April 2025 using an innocent-looking add tool whose hidden description told the agent to read ~/.cursor/mcp.json and ~/.ssh/id_rsa and pass their contents back through a tool argument. Related variants include rug pulls, where a server changes a tool description after the user approved it, and tool shadowing, where one server's description changes how the agent uses another server's trusted tools. Suggested mitigations include showing users the full tool descriptions and pinning server versions.

Primary source: invariantlabs.ai