Invariant Labs describes tool poisoning, in which instructions hidden in an MCP tool's description are visible to the model but not to the user, and shows proof-of-concept exfiltration of local files through an MCP client. It also describes rug pulls, where a server changes tool descriptions after approval, and shadowing, where one server's descriptions alter how the agent uses another server's tools. Recommended mitigations include showing full tool descriptions, pinning tool versions with checksums, and cross-server isolation.
Why it matters
It named the core MCP attack classes that later benchmarks, the OWASP MCP list and client mitigations address.
Key facts
As stated in the sources, with where to find them.
- Authors Luca Beurer-Kellner and Marc Fischer name three classes: tool poisoning, rug pulls and cross-server shadowing.Main post
- Invariant says providers such as Anthropic and OpenAI, the automation service Zapier and MCP clients such as Cursor are susceptible; its proof of concept used Cursor.Main post; experiment section
- Recommended mitigations: show users the tool-description text the model sees, pin server and tool versions with hashes, and enforce dataflow boundaries between MCP servers.Mitigations
Findings that cite this record
Key questions this bears on
- Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
Sources
Related records
May 26, 2025
Mar 30, 2025
Apr 15, 2026
Sep 25, 2025
Aug 19, 2025
Aug 6, 2025