{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/tool-descriptions-steer-agents/",
 "asOf": "2026-09-26",
 "id": "tool-descriptions-steer-agents",
 "claim": "Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.",
 "evidenceKind": "measured",
 "scope": "Demonstrations and a benchmark; success depends on the client and model.",
 "topics": [
  "tool-and-mcp-security",
  "agent-supply-chain"
 ],
 "atlas": [
  "tools",
  "supply-chain",
  "credentials"
 ],
 "evidence": [
  {
   "event": "invariant-mcp-tool-poisoning-2025"
  },
  {
   "event": "mcptox-tool-poisoning-benchmark-2025",
   "note": "Up to 72.8% attack success."
  }
 ],
 "relations": [],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2025-04-01",
   "why": "Invariant Labs describes tool poisoning.",
   "event": "invariant-mcp-tool-poisoning-2025",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2025-08-19",
   "why": "MCPTox measures tool poisoning across agents.",
   "event": "mcptox-tool-poisoning-benchmark-2025",
   "kind": "evidence"
  }
 ],
 "halfLifeDays": 540,
 "wouldChange": "MCP clients that validate tool metadata and block the attack class.",
 "fideQuestions": [],
 "methods": [
  "agent-data-exfiltration",
  "tool-poisoning"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}