WhatsApp MCP tool poisoning — hidden instructions exfiltrate entire message history
Date: 2025-04
Affected: WhatsApp MCP integration — user's complete message history
Attack vector: data-exfiltration
Category: research-demonstrated
Severity: Critical

A malicious MCP server, added alongside a legitimate WhatsApp MCP server, used tool poisoning (hidden instructions in tool descriptions) to silently exfiltrate a user's entire WhatsApp message history. Bypassed end-to-end encryption and DLP because it appeared as normal AI behavior.

Impact: E2E encryption bypass; complete message history theft; invisible to DLP

Mitigations:
Data access monitoring for MCP tool invocations
MCP tool description validation and sanitization
Restrict MCP server sources to verified publishers

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: Malicious MCP server with poisoned tool descriptions
role: origin
label: Agent Frameworks
notes: Agent follows hidden instructions from tool description
role: propagation
label: Data Operations
notes: Entire WhatsApp message history exfiltrated
role: impact