AI agent glossary
Tool poisoning
An attack where malicious instructions are hidden in a tool's name, description, or schema so the model follows them when it reads the tool list.
Models read tool descriptions as part of their context and take them seriously. A malicious or compromised MCP server can exploit that by embedding instructions in a tool description, such as telling the model to read a private file and include its contents in a tool argument, often in text a user never sees in the interface.
Tool poisoning is a form of prompt injection delivered through tool metadata rather than through web pages or documents. A related risk is a server that changes its tool descriptions after you have approved it, sometimes called a rug pull.
Defenses include installing MCP servers only from sources you trust, pinning versions, reviewing tool descriptions, limiting what each server can access, and requiring approval for sensitive actions. Treat every third-party server as code that can influence your agent's behavior.
Learn more in the course
Related terms
Go from definitions to doing
Learn to use and build AI agents in 65 practical lessons.