🎯 Tool poisoning

The items that name it 15

• Rohan Paul (@rohanpaul_ai) on X
  threadas classification.key entities2026-10-29
• Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
  paperas classification.key entities2026-10-26
• ADLC Security Best Practices for Teams Shipping with Coding Agents | Endor Labs
  articleas classification.key entities2026-10-23
• Top MCP security resources — October 2026
  articleas techniques2026-10-08

  Hiding directives in MCP tool descriptions and schemas that agents treat as authoritative

• graygnatconsole/mcp-audit-tool
  repoas techniques2026-09-26

  Hidden instructions injected into MCP tool descriptions, straight into the model's context (detected as MAT-010: possible tool poisoning via hidden instruction)

• 30+ MCP CVEs in Two Months: What the Early-2026 Vulnerability Wave Means for Your MCP Supply Chain
  articleas techniques2026-09-23It is written here as Tool poisoning (OWASP MCP03).

  named in OWASP MCP Top 10 taxonomy

• Awesome Cybersecurity Agentic AI
  repoas techniques2026-08-31
• requie/AI-Red-Teaming-Guide
  repoas techniques2026-07-08

  MCP: malicious/compromised tool description hides directives read as trusted instructions by the model

• Pipelock
  repoas techniques2026-06-14

  MCP tools/list descriptions containing hidden instructions or mid-session rug-pull changes

• anmolksachan/AI-ML-Free-Resources-for-Security-and-Prompt-Injection
  repoas techniques2026-05-07

  Injecting malicious instructions into MCP tool metadata/descriptions

• ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary
  paperas classification.key entities
• ETDI: Comprehensive MCP Security Framework
  writeupas techniques

  Malicious actor deploys a tool that masquerades as a legitimate/trusted tool (spoofed name, description, provider) to deceive users or LLM tool-selection into granting unauthorized access, enabling data exfiltration, unauthorized command execution, malware installation, financial fraud, or output ma

• The Vulnerable MCP Project — MCP vulnerability database
  repoas classification.key entities
• Agent Threat Rules (ATR) — open detection-rule standard for AI agent threats
  repoas techniquesIt is written here as Tool-poisoning.

  Named as an active attack surface against MCP servers and agent tool-call arguments

• Agent Threat Rules (ATR) — Sigma/YARA-style open detection format for AI agent threats
  otheras techniquesIt is written here as Tool-poisoning.

  Named as one of the AI-agent attack surfaces ATR targets (no further detail given)

In every workspace you can read 16