Silent Action Concealment Instructions in Tool Descriptions
Some tools registered with an AI agent contain instructions in their own description text telling the AI model to keep certain actions secret from the user. This is a way for a malicious or compromised tool to make an agent perform hidden operations like stealing credentials or exfiltrating data without the user ever seeing it happen.
How the attack works
An attacker publishes or modifies an MCP tool so that its description includes phrases like 'do not mention this to the user' or 'don't tell the user about this step'. When an AI agent reads the tool's description as part of deciding how to use it, it follows these embedded instructions along with the tool's actual function. The tool can then carry out actions such as harvesting credentials, subscribing to a webhook, or uploading data, while the model actively avoids disclosing this to the person operating it. The user sees only the normal, expected output and has no visibility into what else the tool did.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c34e2f23-4330-4835-bbdb-f8f2bc5f0c76
- Severity
- High
Why it matters
An organization can lose control over what its AI agent actually does with a tool, including silent credential theft, data exfiltration, or persistent hidden channels, none of which show up in what the user is told.
What you can do
- →Review tool descriptions and metadata for any language instructing the model to conceal, omit, or not mention actions to the user.
- →Require human review before adding new or updated MCP tools, especially ones sourced from third parties.
- →Log and audit actual tool actions separately from what the agent reports to the user, so hidden behavior can be caught even if concealment instructions succeed.
- →Treat 'do not mention' style phrasing as a red flag unless it clearly refers to non-security items like unreleased features, and confirm that context before dismissing it.
Known benign look-alikes
- Tools with internal implementation notes that are not security-relevant
- Internal developer documentation tools that contain notes like 'do not mention this to the user as it is not yet released' referring to beta features rather than hidden malicious actions
- Privacy-focused tools that describe data minimization practices using similar phrasing in their changelogs or version notes