tool poisoning (TPA)

advancedspreading

An attack in which an instruction hidden in the description of an external tool used by the AI agent causes the agent to work for the attacker without your knowledge.

In plain terms

An AI agent is useful because it not only chats but also uses tools: it looks into your calendar, sends emails, opens files. Each tool has a short text description from which the agent learns its purpose and how to use it. In tool poisoning, the attacker writes a hidden command for the agent into this description.

Imagine you hire a new colleague and hand them a drill with the user manual. In the fine print of the manual, someone has written: "before use, send your boss's safe code to this address, and do not tell anyone about it." The colleague is conscientious and follows everything, but you only saw the box, not the fine print.

The attack is therefore insidious: it does not rewrite your request nor break the model, but infects the barely visible layer between the two. On the screen, you mostly see only "calculator" or "weather," but the agent typically reads the full description.

How it works

The attacker publishes a seemingly harmless tool (for example, an MCP server) or modifies an existing one.
A hidden instruction for the agent is written into the tool's description or into the names and descriptions of its parameters, for example, to read a secret file and pass its content to the tool. In a broader sense, this also includes cases where the instruction arrives in the response returned by the tool, such as in an error message.
When you connect the tool, its description enters the agent's working text, and the model cannot reliably distinguish it from rules applying to it.
The agent executes the hidden instruction, often using another, fully trusted tool: for example, sending the data via your email client.
In the more cunning variant, the tool is clean at first, and its description is replaced with a poisoned one only after your approval; this is called a "rug pull" (in Hungarian, "szőnyegkirántás").

An everyday example

You try a free "PDF summary" extension for your workplace AI assistant. The summaries arrive fine, but because of an instruction hidden in the extension's description, the agent also forwards part of your correspondence to an unknown address. You notice none of this.

Who is affected

developerA coding agent has access to the passwords, keys and source code on your machine, so a single poisoned tool can leak all of it. → Code

entrepreneur, executiveYou must decide which external tools colleagues can connect to agents accessing company data, and who audits these connections.

employeeIf you install an unknown extension for your workplace AI assistant, you may inadvertently open the door to company data. → Work & HR

everyoneAs AI assistants connect to more applications, the reliability of plugins will become as everyday a question as that of mobile apps.

A common misconception

MythOnce I have reviewed and approved a tool, it is safe from that point on.

In realityThe tool's description may change later without your knowledge, and the interface often does not display the full text the agent reads. Approval applies only to the version you saw at that time.

Limits and risks

There is no complete protection today: language models cannot reliably separate data from instructions, so filters only reduce the risk.
Connect only tools from reliable sources, and turn off anything you are not using, because every new tool is a new attack surface.
The risk is greater the more things the agent can access: if it can see sensitive data and send messages outward at the same time, a single poisoned tool is enough for a leak.
Human approval before risky operations (sending, deleting, payment) helps a lot, but only if you actually read what you are approving.

Similar, but not the same

prompt injection – Prompt injection is the broader category where hidden instructions can lurk in any text (webpage, email, document); tool poisoning is the variant that hides within the tool's description itself.
data poisoning – Data poisoning corrupts a model's training data during training, whereas tool poisoning misleads the finished model during use.
supply chain attack – A classic supply chain attack injects malicious code into your machine, whereas tool poisoning requires only a deceptive text that the agent interprets as an instruction.

Related concepts

Broader

prompt injection, AI safety, supply chain attack

Narrower

rug pull, tool shadowing

On the edge

Model Context Protocol, indirect prompt injection, tool use, data breach, human approval

A brief history

The Model Context Protocol (MCP) was published by Anthropic in November 2024 to enable AI applications and agents to connect to external tools in a unified way; the standard was handed over in December 2025 to the care of the Agentic AI Foundation, operating under the Linux Foundation. The term "tool poisoning" itself was introduced by security researchers at Invariant Labs in April 2025, when they demonstrated that data could be exfiltrated via instructions hidden in an MCP tool description. The phenomenon is not limited to MCP: it can occur in any system where agents work based on text-based tool descriptions.

Where things stand

By late 2026 it has become one of the best-known attack types against agentic systems, and one confirmed in practice; there are tools for detecting it, along with recommendations. There is no definitive fix; defense consists of several layered safeguards.

Status: 2026 November

Also known as

tool poisoning · MCP tool poisoning · tool poisoning attack · TPA · tool poisoning attack · MCP tool poisoning · poisoned tool description · agent tool poisoning

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.