MCP Tool Description Unicode Confusable Deception
Some tools registered with AI agents (via the Model Context Protocol, or MCP) describe themselves using letters that look like normal English but are actually Cyrillic, Greek, or other Unicode lookalikes. This lets an attacker make a tool's description look trustworthy while hiding its real, different meaning from anyone reading it quickly.
How the attack works
An attacker publishes or modifies an MCP tool or skill and writes its description using Unicode characters that are visually identical to Latin letters, such as a Cyrillic 'а' instead of a Latin 'a'. A human or automated reviewer sees what looks like a normal, benign description. The AI agent that reads and acts on the tool's metadata may also be misled, since it trusts the description to reflect what the tool actually does. The attacker uses this gap to get a malicious tool approved or invoked without raising suspicion.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- b3f7a291-4c1e-4d8b-a3f2-7c0e5d2b1f94
- Severity
- High
Why it matters
An organization can end up trusting and running a malicious tool because its description passed a visual review, leading to unauthorized actions performed by an AI agent under a false pretext.
What you can do
- →Normalize and inspect tool and skill descriptions for mixed-script or lookalike Unicode characters before approving them.
- →Flag or reject tool metadata that mixes scripts unexpectedly, especially where a mostly-English description contains isolated Cyrillic or Greek characters.
- →Keep an allowlist of expected languages/scripts for your environment and review exceptions manually.
- →Log and review the exact byte/codepoint content of tool descriptions, not just their rendered appearance.
Known benign look-alikes
- Multilingual skill descriptions legitimately containing Cyrillic or Greek text
- Skills designed for Russian or Greek-language users