MCP tool poisoning: the new supply chain attack
The Model Context Protocol (MCP, see "What is MCP (Model Context Protocol)?") became the standard infrastructure in 2026 through which AI agents access external tools and data sources. That's exactly what makes MCP servers an attractive attack target: in "tool poisoning", malicious instructions are embedded directly in tool descriptions, parameter schemas, or response content – content an agent routinely treats as trusted operational context, not as a possible attack.
Why this is more dangerous than classic prompt injection
The decisive difference from classic prompt injection is persistence: a poisoned tool description sits fixed inside a package or a remote MCP server and works on every single invocation – silently, across every session, for every user, until somebody notices. OWASP has since anchored this pattern as its own category in an "MCP Top 10", right next to related attacks like "rug pulls" (tool descriptions altered after the fact) and "tool shadowing" (a malicious tool impersonating a trusted one).
Real cases from 2026
This attack class isn't theoretical: a malicious MCP package disguised as a legitimate email integration was distributed through a public package registry. An established malware operation spent three months building a fake developer ecosystem before submitting a trojanized MCP server for a popular wearable device – with malware that harvested browser passwords, cloud session tokens, credentials, SSH keys, and cryptocurrency wallets. A separate worm specifically targeted MCP server packages; a compromised library was downloaded roughly 47,000 times within three hours. A 2026 survey found at least one exploitable vulnerability in over 30% of deployed MCP servers.
Practice section: treat tools like software dependencies
The most important shift in perspective: an MCP server or an AI tool is a software dependency like any other – and deserves the same care. Concretely, that means: only integrate tools from a trusted, vetted source, re-check tool descriptions on updates instead of trusting them once, and – as described in the prompt injection module – give every tool only the minimum rights it needs. A tool that can only read can't leak credentials it never had, even if poisoning succeeds.