Tool poisoning is an attack in which malicious instructions are hidden inside tool descriptions, examples, or schemas that an AI agent reads when deciding what to do. The danger is not only in the tool's code, but in the metadata that shapes the agent's behaviour and trust decisions.
What Tool Poisoning Exploits
Tool poisoning targets the layer where an agent decides which tool to trust, not just the tool's executable behaviour. By hiding instructions in descriptions, examples, schemas or metadata, an attacker can steer selection, invocation, or parameter handling before any useful work begins. That makes the attack especially effective against systems that treat tool metadata as guidance rather than untrusted input.
Because the compromise sits in the decision surface, the agent may appear to be following normal instructions while actually being nudged toward unsafe calls. This is why tool poisoning is closely related to tool misuse, prompt injection and malicious tool supply chains, even when the underlying tool code is unchanged.
Why It Matters for Agentic Systems
Agentic systems often rely on tool catalogs, plugin manifests, function signatures and examples to infer capability and intent. If those sources are poisoned, the agent can be tricked into selecting the wrong tool, passing unsafe parameters, or trusting a malicious workflow as if it were approved. The result is not just a bad output, but a bad action taken under delegated authority.
The AI Agent Tool and Plugin Security Guide is useful here because it focuses on the tool metadata, permission scoping and validation problems that make this attack possible. For broader threat framing, the Agentic AI Security Guide shows how tool trust fits into a layered agent security model.
Common Poisoning Paths
Tool poisoning usually enters through content that developers, gateways or agent runtimes assume is descriptive rather than adversarial. That includes natural-language tool descriptions, sample prompts, schema fields, parameter examples, changelogs and marketplace listings. A malicious or compromised source can use that metadata to bias an agent toward a covert action, a shadowed tool name, or a misleading affordance.
It also appears in ecosystem and supply-chain scenarios, where a previously trusted tool source is updated with subtly altered metadata. The Prompt Injection Guide is relevant because it covers tool description poisoning and hidden instruction patterns, while the OWASP Agentic Top 10 ASI04 Guide maps the supply-chain side of malicious tool and server onboarding.
Security Implications and Control Boundaries
Tool poisoning is dangerous because it attacks trust boundaries that many agent designs leave implicit. If the system does not separate untrusted tool metadata from executable policy, then the metadata can shape authorization decisions, tool ranking and downstream side effects. That can turn a harmless-looking integration into a path for data exposure, unauthorized actions or chained abuse across multiple tools.
Defences therefore need to treat tool metadata as untrusted until it is validated, constrained and monitored. The MCP Server Trust Assessment is relevant for pre-connection due diligence, and the MCP Gateway Buyers Guide is useful when enforcement needs to happen at the gateway rather than inside each client.
Risk and Threat Considerations
Tool poisoning can create a silent compromise path because the malicious payload lives in data the agent expects to read. The risk is highest when tool catalogs are auto-discovered, marketplace content is trusted too quickly, or the agent can chain tool use with limited human review.
Failure mechanism: Poisoned descriptions, schemas or examples bias the agent's tool selection and parameter choices, causing unsafe invocation, privilege misuse or trust in a rogue integration.
Impact: The agent may expose data, execute unauthorized actions, or amplify a compromise across connected systems and downstream tools.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Tool poisoning steers an agent into unsafe tool selection and invocation. |
| ASI04 — Agentic Supply Chain Vulnerabilities | Poisoned tool metadata often arrives through compromised or altered tool supply chains. | |
| ASI03 — Identity & Privilege Abuse | Poisoned tool instructions can steer delegated authority into misuse or overreach. | |
| Recommendation — Enforce pre-execution policy gates and per-tool least privilege to block poisoned tool use. Vet, pin and sandbox tool sources before the agent can trust their metadata. Constrain delegated authority so tool metadata cannot expand agent privilege. | ||
| MITRE ATT&CK | T1204 — User Execution | The attacker relies on a target following malicious instructions embedded in trusted-looking content. |
| Recommendation — Hunt for execution paths where trusted content induces unsafe user or agent action. | ||
| NIST SP 800-53 Rev 5 | SA-11 — Developer Testing and Evaluation | Poisoned tool metadata is a software and integration assurance problem that must be tested. |
| Recommendation — Verify tool descriptors, schemas and examples during security testing and evaluation. | ||
Practitioner Guidance
Why practitioners should care: Tool poisoning is not just a content-quality problem, it is a control problem. Any environment that lets agent behaviour be shaped by third-party or mutable tool metadata needs explicit review, provenance checks and runtime guardrails around what the agent is allowed to believe.
Practitioner takeaway: Treat tool metadata like untrusted input, and validate it with the same scepticism you apply to user-supplied prompts or external API responses.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org