Researchers show MCP tool descriptions can trigger live agent tool execution and secret exfiltration

A new research paper says poisoned descriptions inside MCP tools can do more than merely influence a chatbot’s text output: They can trigger real tool execution, make agents contact attacker-controlled infrastructure and, in some cases, exfiltrate secrets that were independently verified by the researchers. The authors say that in the 12 agentic AI frameworks they tested, they found no intentional framework-level defenses against that path.

The paper, “MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study,” was posted to arXiv on Nov. 2 as arXiv:2611.03555v1 and says it was accepted to AISec ’26, the 19th Workshop on Artificial Intelligence and Security, co-located with ACM CCS 2026. Its authors, Farooq Shaikh and Biagio Montaruli of Dynatrace in Linz, Austria, tested 12 frameworks, 18 models and 45 attack scenarios, producing 9,720 test cells. According to the paper, 22.9% of those cells, or 2,113 cases, were vulnerable. Among them were 255 cases of verified secret exfiltration, alongside 487 cases of confirmed contact with an attacker endpoint and 1,371 cases in which an attacker-directed tool call was dispatched.

The authors describe the work as “the first cross-framework measurement of MCP tool poisoning with real tool execution,” distinguishing it from earlier studies that mainly measured whether a model appeared willing to comply with poisoned instructions. Here, the paper says, attacks were validated with a dual-oracle approach: transcript evidence showing what the agent did, plus independent canary HTTP receipt confirming that data or a callback reached infrastructure controlled by the researchers.

The code-level audit in the paper says all 12 tested frameworks passed tool description content into the model’s context without validation, and that “no framework implements intentional tool-description defense.” At the same time, the authors say resistance appeared to depend more on the model than on the framework wrapped around it. Across the tested systems, model-level attack success ranged from 0.4% to 49.7%, according to the paper. As one example, the paper reports that Claude Opus 4.8 was vulnerable in eight of 530 evaluated cells while issuing 223 explicit refusals.

The paper also says the authors made five coordinated disclosures to four organizations and that all five were rejected. The organizations named in the disclosure summary include LangChain, AutoGen through the Microsoft Security Response Center, the MCP SDK and Haystack through deepset. In one response quoted in the paper, LangChain said: “This library is expected to be passing the information exactly as specified in the MCP resources. This is not the appropriate place for any sort of validation.” Another response quoted in the paper, from the MCP SDK, said: “The protection against rug-pulls is host-side review of tool calls, not a notification the attacker controls.”

MCP, short for Model Context Protocol, is an open protocol used by AI agents to discover and use external tools. In common implementations, tool metadata — including descriptions and schema fields — can be inserted directly into the model’s prompt or working context. That matters because if a tool provider controls that text, the description itself can become a prompt-injection channel, steering the model toward actions it otherwise should not take. Tool poisoning has already been flagged as a security issue by researchers and industry groups, with public demonstrations in 2025 and 2026 guidance from organizations including OWASP and the National Security Agency touching on MCP-related security design.

To support reproduction, the authors released an open-source test harness called mcpvenom on GitHub, along with attack scenarios, malicious and legitimate MCP servers, canary infrastructure and frozen artifacts intended to reproduce the published results. The paper says the full test matrix was run from July 22 to July 24, 2026, a timing detail that matters because model and framework behavior can change as providers update systems. In other words, the study offers a measured snapshot of exposure during that period, not a guarantee that every July result still holds unchanged today.