Week of Mar 31 – Apr 6, 2025

Invariant Labs describes tool poisoning, in which instructions hidden in an MCP tool's description are visible to the model but not to the user, and shows proof-of-concept exfiltration of local files through an MCP client. It also describes rug pulls, where a server changes tool descriptions after approval, and shadowing, where one server's descriptions alter how the agent uses another server's tools. Recommended mitigations include showing full tool descriptions, pinning tool versions with checksums, and cross-server isolation.

Google announced Sec-Gemini v1, an experimental model combining Gemini with Google Threat Intelligence, OSV and Mandiant data for tasks such as incident root-cause analysis and vulnerability impact assessment. Google reports it outperforms other models by at least 11% on CTI-MCQ and 10.5% on CTI-Root Cause Mapping, and offered free research access to selected organizations.