aisecurityrisks.com

# R-11·cases 2·checked Nov. 15, 2026

MCP and agent tool poisoning

A tool or MCP server an agent trusts carries hidden instructions, changes after approval, or is malicious outright.

What it is

The Model Context Protocol lets agents discover and call tools from servers. The model reads each tool's description, so instructions hidden there steer the agent even if the tool is never called. Researchers have shown tool descriptions that make an agent send files to an attacker, and described servers that change a tool after the user approved it.

Local MCP servers are programs running on your machine with your privileges. The MCP specification requires clients that offer one-click setup to show the exact command and get consent before running it.

Documented cases

Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.

  • Incidentdisclosed Sept. 25, 2025·AML.CS0053

    Fake Postmark MCP server copied every email to an attacker

    Someone published an npm package called postmark-mcp that posed as an MCP server for the Postmark email service. After 15 harmless versions, version 1.0.16 added a backdoor that blind-copied outgoing email to an external server.

    Postmark says it had nothing to do with the package. It told users to remove it, check email logs and consider rotating any credentials sent by email while it was installed.

    Sources: Postmark; MITRE ATLAS AML.CS0053

  • Research demodisclosed April 1, 2025·AML.CS0054

    Hidden instructions in an MCP tool description

    Invariant Labs put instructions in the description of an innocent-looking add tool. In Cursor, the agent then read the user's MCP config file and SSH private key and sent them out through a hidden tool parameter. The confirmation dialog did not show the full input.

    The researchers also described rug pulls (a server changes a tool after approval) and shadowing (one server's tool description changes how the agent uses another server's tool). They recommend pinning server versions and showing users full tool descriptions.

    Sources: Invariant Labs; MITRE ATLAS AML.CS0054

Controls to start with

  • Allowlist and pin MCP servers and tools by version or content hash, and re-check them on update.ASI04, guidelines 2 and 7
  • Show users the full tool description and the full arguments of each call before approval.Mitigations
  • Run local MCP servers sandboxed, with minimal file system and network access, after showing the exact startup command.Local MCP Server Compromise, mitigation
  • Don't let an MCP server pass a client's token straight through to another API. The specification forbids token passthrough.Token Passthrough

Questions to ask vendors

Our suggestions, not taken from a framework.

  • Which MCP servers does the product connect to, who publishes them, and are versions pinned?
  • Can tool descriptions change after we approve them, and would we be told?
  • Do local servers run sandboxed or with the user's full privileges?

Sources

  1. OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.Standard or framework · read: full text (PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Covers risks once a model acts as an agent with tools, memory and delegated authority.
  2. MCP Security Notification: Tool Poisoning Attacks. Invariant Labs, April 1, 2025.Security vendor research · read: full page · retrieved Nov. 15, 2026note: Invariant Labs builds agent security tooling.
  3. Model Context Protocol: Security Best Practices (specification version 2025-11-25). Model Context Protocol project, Nov. 25, 2025.Official documentation · read: full page · retrieved Nov. 15, 2026note: Covers confused deputy, token passthrough, SSRF, session hijacking and local server compromise.
  4. OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.Standard or framework · read: full text (122-page PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Community list. OWASP says the 2026 ranking combines a practitioner vote with incident evidence. Appendix A maps each entry to other frameworks.
  5. MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.Standard or framework · read: full data file (tactics, techniques, case studies) · retrieved Nov. 15, 2026 · license Apache-2.0note: ATLAS labels each case study as an Incident (real-world) or an Exercise (research or red-team demonstration).
  6. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.Government guidance · read: sections 2.4 (Data Privacy), 2.7 (Human-AI Configuration) and 2.9 (Information Security) read in full · retrieved Nov. 15, 2026 · license US government worknote: Voluntary profile. Names 12 risks that generative AI creates or makes worse.
  7. Information regarding malicious postmark-mcp package. Postmark, Sept. 25, 2025.Incident disclosure by an involved party · read: full page · retrieved Nov. 15, 2026note: Postmark is the impersonated vendor, not the package author.