Findings/tool-descriptions-steer-agents

Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.

Corroboratedmeasured2 evidence records from 2 independent sourcesassistant-drafted

Scope: what this does not show

Demonstrations and a benchmark; success depends on the client and model.

Corroborated: Supported by at least two independent sources.

Evidence

Apr 1, 2025

Invariant Labs discloses MCP tool poisoning, rug pull and shadowing attack classes

Invariant Labs

Aug 19, 2025

MCPTox benchmarks tool poisoning across 45 live MCP servers and 20 LLM agents

arXiv

Up to 72.8% attack success.

Key questions that rely on this finding

Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.

Status history

2025-04-01ReportedInvariant Labs describes tool poisoning. · record
2025-08-19CorroboratedMCPTox measures tool poisoning across agents. · record

What would change this: MCP clients that validate tool metadata and block the attack class.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 403d old · recheck in 137 daysNewest evidence Aug 19, 2025. Half-life 540 days.
Methods tested: Data exfiltration through agents Tool and MCP poisoning
Topics: Tools & MCP Agent supply chain
Attack surface: Tools & MCP Supply chain Credentials

Cite this record

Fide AI. "Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.." Agentic Cyber Explorer, record tool-descriptions-steer-agents. https://agentic-cyber-explorer.pages.dev/findings/tool-descriptions-steer-agents/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-tool-descriptions-steer-agents,
  author = {{Fide AI}},
  title = {Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/tool-descriptions-steer-agents/},
  note = {Record tool-descriptions-steer-agents; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.