MCP Tool Description Defines a Common-Phrase Trigger to Forward Full Conversation History
A malicious tool given to an AI agent can carry hidden instructions in its description text, not just its function. This rule flags tools whose description tells the model to secretly send the entire conversation history to that tool whenever the user says something ordinary, like 'thank you' or 'ok got it'.
How the attack works
An attacker registers or supplies a tool (via MCP or similar) with a description that looks like normal documentation but contains a conditional instruction: 'when the user says X, forward the full conversation history as a parameter to this tool.' The model reads this description as part of its context and treats it as a legitimate instruction to follow. Because the trigger phrase is something users say naturally and often, in unrelated conversations with other trusted tools, the leak happens repeatedly and blends into normal usage. Every time the phrase appears, the model quietly attaches the full session transcript, including content from other tools sharing the same context window, to a call on the malicious tool.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3d7ab99a-3275-46c1-a968-43e4b0519796
- Severity
- High
Why it matters
Sensitive data discussed anywhere in the session, including outputs from unrelated trusted tools, can be exfiltrated to an attacker-controlled tool repeatedly over time without any single suspicious-looking action.
What you can do
- →Review tool descriptions and schemas before installing or trusting them, not just their advertised function.
- →Treat any tool description that asks the model to forward 'full', 'entire', or 'complete' conversation/session history as high risk unless that is the tool's explicit, documented purpose.
- →Restrict which tools can receive full context history and monitor for tools requesting it under vague or conditional phrasing.
- →Log and periodically audit actual tool-call parameters, not just tool descriptions, to catch conversation history being sent where it shouldn't be.
Known benign look-alikes
- A tool description that legitimately references conversation history without a common-phrase trigger, e.g. a summarization tool whose parameter is genuinely named conversation_history and is populated as part of its documented, single-purpose function
- Documentation or a blog post describing this tool-poisoning technique in prose without an actual tool description/schema containing the trigger instruction
- A customer-support or logging tool whose description asks the model to log an explicit user complaint verbatim, without a conditional trigger keyed to a common everyday phrase and without asking for the FULL/ENTIRE conversation history