A rug pull attack is a delayed poisoning pattern where a tool appears safe during review and then changes later on the provider’s server. The agent fetches the new description at runtime, so the approved state and the active state are no longer the same.
What a rug pull attack changes
A rug pull attack is dangerous because the review-time view is not the runtime view. The tool or plugin can look benign when it is approved, then later change its server-hosted description or behavior so an agent receives different instructions, permissions, or expectations after trust has already been granted.
This makes the attack a delayed poisoning pattern rather than a one-time bad artifact. The core security problem is drift between the vetted state and the live state, especially when the agent fetches tool metadata, schemas, or other operational details on demand.
Why this attack pattern works
Rug pulls exploit the fact that many tool ecosystems treat remote descriptors as current truth. If the serving side can alter the tool definition after approval, the control that reviewed the original version no longer protects the active one.
The attacker does not need to win the initial review if they can preserve legitimacy long enough to pass it. After that, changes can be introduced through content updates, descriptor swaps, or other server-side mutations that are harder to notice than a new package or a fresh install.
Where the trust boundary fails
The failure point is usually the assumption that approval of a tool once means approval of that tool forever. In practice, the trust boundary has to include the source of truth for the tool definition, not just the first copy an operator saw.
That is why change control, provenance checks, and version pinning matter for agent tools. The security question is not only whether the tool was safe at onboarding, but whether the live descriptor remains the same artifact the review approved. NHIMG’s MCP Server Trust Assessment is useful here because it focuses on provenance, change control, and the conditions a server must satisfy before an agent is allowed to rely on it.
How defenders should think about exposure
Exposure increases when agents auto-refresh tool metadata, when external servers are treated as authoritative, or when a platform lacks strong integrity checks on tool definitions. The broader the tool estate and the looser the governance, the easier it is for a trusted integration to drift into a poisoned one.
Defenders should also treat this as a supply-chain-style problem, not just an application bug. The risk is not limited to one malicious endpoint; it is the possibility that a whole class of approved tools can be silently reshaped after review. NHIMG’s AI Agent Tool and Plugin Security Guide is directly relevant because it covers tool poisoning, scoped permissions, and validation of agent-executed tools.
Risk and Threat Considerations
Rug pull attacks are especially dangerous because they abuse trust established earlier in the lifecycle. A benign review can be followed by a malicious change, so defenders may believe a tool is safe while the agent is already consuming altered instructions or capabilities.
Failure mechanism: The attacker changes the server-side tool definition, schema, or description after approval, creating a mismatch between the reviewed artifact and the runtime artifact the agent actually trusts.
Impact: The agent can be steered into unsafe actions, unintended data exposure, or malicious tool use even though the original approval record still appears valid.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | Rogue tool servers and altered descriptors create an externally reachable trust path that attackers abuse. |
| Recommendation — Monitor exposed tool endpoints for descriptor tampering and correlate changes with suspicious access patterns. | ||
| OWASP Agentic AI Top 10 | ASI04 — Agentic Supply Chain Vulnerabilities | Rug pulls are a supply-chain style integrity failure in agent tool ecosystems. |
| Recommendation — Pin trusted tool definitions and verify updates before an agent consumes them. | ||
| CIS Controls v8 | CIS-15 — Service Provider Management | Third-party or hosted tool sources need governance because their changes affect trusted runtime behavior. |
| Recommendation — Require provider assurance and change notifications for externally hosted tools and plugins. | ||
| NIST CSF 2.0 | PR.DS-08 — Integrity mechanisms are implemented to verify software, firmware, and information integrity | The term centers on runtime integrity drift between reviewed and active tool content. |
| Recommendation — Implement integrity checks that detect when approved tool content changes after review. | ||
Practitioner Guidance
Why practitioners should care: Tool approval needs to cover the live source of truth, not just the version seen during onboarding. If the runtime descriptor can change without detection, the approval process is only partially effective.
What to watch for: Any tool that is fetched dynamically, updated outside a controlled release process, or lacks strong version pinning deserves extra scrutiny. NHIMG’s MCP Incident Response Playbook is a good companion when a tool is suspected of being compromised, because it centers response on revocation, blast radius, and recovery.
Practitioner takeaway: The safest assumption is that a remote tool can change after approval, so integrity controls must be designed to detect that change before the agent acts on it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org