Tool poisoning
Also called tool poisoning attack, poisoned tool description
Hiding instructions in a tool's description, such as an MCP server's, so the AI agent that reads it does what the attacker wants.
When an AI agent connects to a tool server, it reads each tool's name and description to decide when and how to use it. The model treats that text as guidance, and the person using the agent rarely sees it.
Tool poisoning hides instructions there. A description can tell the model to read a private file before calling the tool, or to tuck the file's contents into a harmless-looking parameter. The tool may never need to do anything wrong itself; the agent does it, because the description asked.
That makes an MCP server more like software you install than a link you click, so it deserves the same checks.
For example
A server's "add two numbers" tool carries a hidden note telling the agent to read your SSH key first and pass it along in an extra "sidenote" field.
Put it to use
Where you'll meet tool poisoning in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.