MCP tool poisoning — hidden instructions in Model Context Protocol tool descriptions
Date: 2025-04-01
Affected: Any MCP-connected agent (Claude Desktop, VS Code extensions, custom agents)
Attack vector: supply-chain
Category: research-demonstrated
Severity: Critical

Security researchers demonstrated that Model Context Protocol (MCP) servers can embed hidden malicious instructions in tool descriptions that are invisible to users but processed by the LLM. These hidden instructions can exfiltrate data, modify tool behaviour, or override safety controls. The attack exploits the trust boundary between MCP server descriptions and the agent's decision-making, requiring no user interaction.

Impact: Data exfiltration, unauthorised tool invocations, safety bypass via trusted tool descriptions

Mitigations:
Implement user confirmation for sensitive tool operations
Monitor tool invocation patterns for anomalous data flows
Restrict tool access to pre-approved MCP servers with verified publishers
Validate and sanitise MCP tool descriptions before presenting to model

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: Malicious MCP server provides tool descriptions with hidden instructions
role: origin
label: Agent Frameworks
notes: Agent processes hidden instructions as trusted tool documentation
role: propagation
label: Data Operations
notes: Data exfiltration via malicious tool invocations
role: impact