← Back to Blog

AI Cybersecurity · 8 min read · November 2, 2026

What Is MCP Tool Poisoning? How Poisoned AI Tools Steal Credentials in 2026

Your AI agent trusts every tool description it loads, and that trust is the vulnerability. Independent 2026 audits found exploitable flaws in 30-82% of public MCP servers while only 8.5% use OAuth. Here is how tool poisoning, rug pulls and tool shadowing work, and which controls actually hold.

Why MCP broke the assumption API security was built on

With a normal API, the caller sends a request and receives a response. The client never reads the server’s internal notes as instructions. The Model Context Protocol collapses that boundary: tool descriptions, parameter schemas and returned content all enter the model’s context as trusted natural language, and the agent cannot reliably tell a capability description from a command.

That is the whole vulnerability class in one sentence. It is not a missing patch. As of mid-2026 the specification offered no attestation of tool description integrity, no way for a client to confirm a server’s definitions still match what was reviewed, and no runtime inspection of description text. OWASP codified tool poisoning as MCP03:2025.

The three attacks that share one root cause

• Tool description poisoning. Instructions are embedded in tool metadata. Client interfaces show a trimmed description, so the user approves something benign while the model reads the payload.
• Rug pulls. The server behaves, passes review, gets approved — then rewrites its own descriptions. Consent was given to a tool that no longer exists.
• Tool shadowing. A malicious server poisons how the agent uses a different, trusted server. You do not need to compromise the tool holding the data, only any tool in the same context.

Invariant Labs demonstrated this publicly in April 2025, exfiltrating WhatsApp message history and private GitHub repository contents with no user prompt. The poisoned description looked benign in the review interfaces tested. Cursor did not re-validate tool definitions after approval, so committing a clean config and swapping it later worked; that was patched in Cursor 1.3 in July 2025. The class itself was not.

What the 2026 audits actually measured

Adoption ran far ahead of security maturity: more than 97 million monthly SDK downloads and 10,000+ public servers by December 2025, with first-class support in ChatGPT, Claude, Cursor, Gemini, Copilot and VS Code. Independent scanning produced a consistent picture.

• Endor Labs: 82% of 2,614 implementations handled file operations in a way prone to path traversal.
• Equixly: 43% of tested servers vulnerable to command injection. BlueRock: 36.7% of 7,000+ servers exposed to server-side request forgery.
• Enkrypt AI: 33% of 1,000 servers carrying a critical vulnerability. AgentSeal: some finding in 66% of 1,808 servers.
• Astrix: of 5,200+ servers, only 8.5% used OAuth. The rest lean on static API keys and personal access tokens in environment variables.
• Trend Micro: 492 servers exposed to the open internet with no authentication or encryption; a follow-up count reached 1,467.

Read the percentages as direction. One assessment of YARA-based MCP scanners recorded a false-positive rate near 78%, so figures vary sharply by methodology. The CVE record does not.

The CVEs have nothing to do with the language model

CVE-2025-6514 in mcp-remote scored CVSS 9.6, OS command injection in a package with 437,000+ downloads. CVE-2025-49596 in Anthropic’s MCP Inspector scored 9.4, remote code execution via DNS rebinding. CVE-2025-54136, the Cursor config swap, scored 7.2. More than 40 MCP-related CVEs were filed in 2026 alone, including an August trio: path traversal in Atlassian’s Confluence MCP tool, a cleartext cluster token in ArcadeDB, and SSRF in a Facebook Ads MCP server.

Every one is a classic web bug. An MCP server exposes ordinary application logic to an extraordinary caller — one that makes thousands of consistent tool calls at machine speed, turning a defect a human might stumble into a routine step.

Deadbugz: the server that waits three calls

In September 2026 a campaign called Deadbugz filed 23 pull requests across unrelated developer projects in 74 minutes from one account. The server behaved exactly as advertised for its first three tool calls, then rewrote its metadata into instructions hunting SSH keys, cloud credentials, shell history and Kubernetes configuration, while concealing the activity.

Install-time scanning cannot solve this. A scanner sees a clean server because at review the server is clean. Trust is granted to a snapshot and exercised against a live, mutable object.

Why a crypto team’s agent is the highest-value target

An agent holding a wallet connection, deploy key or CI secrets is worth far more than one reading support tickets. MCP configuration files already appear in secret-scanning data: one analysis counted 24,008 unique secrets across MCP configs, 8.8% still valid. A single poisoned tool in that context can redirect a signing step or rewrite a recipient address in a transaction nobody re-reads.

Private data access, untrusted content and outbound reach in one loop — the lethal trifecta — describes the default developer setup, not an edge case.

Seven controls that hold up

1. Inventory and allowlist. Most teams cannot name the servers their agents connect to. Start there, and permit nothing outside the list.
2. Hash and pin tool definitions. Store a digest of every description and schema at approval, and alert on change. This is the only control that addresses mutation.
3. Put a gateway in front. An MCP proxy logs every call with parameters, applies policy and supplies the audit trail the protocol lacks.
4. Treat tool output as hostile input. A returned issue body or web page is an injection vector, handled like any untrusted prompt input.
5. Scope credentials per server. Short-lived tokens, no shared PATs in environment variables, OAuth where supported, a separate identity per integration.
6. Deny egress by default. Block 169.254.169.254 from agent hosts and allow only named destinations. Most SSRF and exfiltration paths die here.
7. Sandbox and confirm. Least-privilege filesystem access, plus human approval for transfers, deletions and deploys.

First hour after a suspected poisoning

Disable the server rather than deleting it, so the evidence survives. Rotate every credential the agent could reach, diff current tool definitions against the pinned hashes to locate the mutation, and pull gateway logs for credential-shaped parameters or destinations the task never required. A deleted rug-pulled server leaves its tokens valid, which is exactly what the attacker counted on.