MCP Tool Supply Chain Poisoning
AI agents that use Model Context Protocol (MCP) tools trust the tool's description, schema, and return values as instructions. If an attacker can plant hidden commands or malicious payloads inside those fields, the agent may execute code, leak data, or escalate its own privileges just by calling the tool normally.
How the attack works
An attacker compromises or publishes a malicious MCP tool, or tampers with an existing one's metadata, description, schema, or return values. The poisoned content is written to look like normal tool output or documentation but actually contains embedded instructions such as shell commands or prompt-injection strings like 'Ignore previous instructions'. When an agent invokes the tool as part of normal operation, it reads and acts on the injected content instead of treating it as inert data. This can trigger unintended code execution, exfiltrate data the agent has access to, or expand the agent's permissions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 0cd29ad0-9142-4cf1-bbcb-7144d26478e3
- Severity
- Critical
Why it matters
An organization using compromised or unvetted MCP tools can have its AI agents silently execute attacker-controlled commands, leak sensitive data, or gain elevated access — all through what looks like a routine tool call.
What you can do
- →Vet and pin MCP tool sources; avoid pulling tool definitions from unreviewed or third-party registries without inspection.
- →Treat tool descriptions, schemas, and return values as untrusted input — do not let agents execute instructions found inside them without validation.
- →Log and review tool invocation inputs/outputs for embedded command-like strings or prompt-injection patterns, while expecting some false positives from legitimate security or educational tooling that quotes exploit examples.
- →Restrict agent permissions so that a single poisoned tool call cannot escalate privileges or exfiltrate broad data on its own.
Known benign look-alikes
- Legitimate security scanning tools that reference exploit patterns in their output
- A penetration testing tool that includes example exploit payloads such as subprocess.run() calls in its educational documentation output
- Prompt-injection defence documentation that quotes the indicator string verbatim - a skill listing "Ignore previous instructions" or "[SYSTEM]" in a catalogue of payloads to watch for is textually identical to the payload itself. This is the residual false-positive class after the 2026-08-04 tightening and is not reducible by pattern matching.