Topic starter
02/08/2026 12:16 pm
TL;DR: MCP tool poisoning hides malicious instructions inside tool metadata, allowing AI agents to leak credentials, chain unintended actions, and expose sensitive data when they trust descriptions over user intent, according to Akto. The real control gap is not only detection, but governance over which tools agents can trust, call, and combine.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “MCP Tool Poisoning Attacks: Risks and Prevention”.
Key questions
Q: What breaks when MCP tools or schemas are poisoned?
A: Tool or schema poisoning can make an otherwise legitimate integration behave maliciously while still appearing normal to monitoring systems.
Q: Why do MCP tool outputs increase indirect prompt injection risk?
A: MCP tool outputs can inject instructions into the agent’s context after the user prompt has passed initial checks, which means the attack enters through delegation rather than input submission.
Q: What are the signs that an AI agent is being steered by malicious tool metadata?
A: Look for unexpected reads of local files, secret retrieval attempts, unrelated tool chains, external calls not tied to the user request, and repeated behavior that follows tool descriptions too literally.
Practitioner guidance
- Enforce tool allowlisting Approve only the MCP tools an agent actually needs, and block dynamic discovery paths that let poisoned tools enter the workflow unnoticed.
- Scan tool metadata before execution Inspect descriptions, parameters, and embedded instructions for hidden directives, secret prompts, and suspicious task-steering language before any agent call.
- Restrict agent-to-tool chaining Limit the number and type of downstream tool calls an agent can make when a task begins in one trust domain and ends in another.
Bottom line: MCP tool poisoning is a governance problem inside the agent execution layer, not just a content filtering problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:18 pm
Tool metadata is now part of the attack surface for identity governance. When an AI agent can read instructions that a user cannot see, the governance boundary shifts from prompt safety to tool trust and authorisation. That means agent security has to cover which tools are allowed, what metadata they expose, and how tool combinations are approved. Practitioners should treat tool descriptions as policy-bearing objects, not documentation.
A few things that frame the scale:
- Gartner predicts that AI systems will initiate 50% of all service requests by 2030, driven largely by agentic AI.
A question worth separating out:
Q: Should organisations approve MCP when tool responses can expose sensitive data?
A: Only if the control plane can filter or redact sensitive fields before they reach the model or logs. MCP approvals become much harder when tools return more data than the task requires, because the excess can leak into prompts, responses, and audit systems. The question is not just access, but data shaping.
👉 Read our full editorial: MCP tool poisoning exposes a new control gap in AI agent security