Tool poisoning
Tool poisoning is an attack in which the description or metadata of a tool available to an AI agent is written to manipulate the model. Because the agent reads those descriptions to decide what to call and how, the description is untrusted input that reaches the model with the authority of configuration.
It is indirect prompt injection delivered through a channel nobody reviews. A tool definition contains a name, a description and a parameter schema, all free text, and all of it is placed in the model’s context. Instructions hidden there can tell the agent to call a different tool first, to append data to an argument, or to ignore a constraint, and they arrive before the user has typed anything.
Two variants make it worse than a static review would suggest. A server can change a tool’s description after it has been approved and connected, so what was audited on day one is not what the model reads on day thirty. And where several servers are connected at once, a description belonging to one can reference and redirect the behaviour of another, because the model sees a single flat list and has no notion of which server it should trust for what.
The controls follow from that. Pin tool definitions and detect changes rather than fetching them fresh and trusting them; keep servers from different trust levels out of the same session; and enforce authorisation at the tool endpoint so that a manipulated call still fails. When we assess an agent built on Model Context Protocol we read every connected description as attacker controlled text, which is the basis of the AI testing that inspects every tool an agent is allowed to call.