Definition
Tool poisoning manipulates a tool's description, schema, implementation, package, or output so an AI agent chooses an unsafe capability or follows attacker-controlled instructions. In an MCP or plugin ecosystem, the poisoned material may arrive during discovery, installation, capability negotiation, or a later tool call.
Descriptions and schemas are part of the attack surface because models use them to decide what a tool does and when to call it. A harmless-looking update can change hidden instructions, redirect a parameter, impersonate another tool, or return content designed to influence the agent's next step.
Treat tools as supply-chain dependencies and active security principals. Pin versions, verify publishers and artifacts, review metadata changes, isolate execution, minimize permissions, label returned content as untrusted, and require policy checks before a tool's output can trigger a consequential action.
Distinguish it from nearby terms
Indirect prompt injection is a way to deliver hostile instructions through external content. Tool poisoning specifically compromises a capability or its interface and may use indirect injection as one technique. A poisoned package changes executable code; a poisoned description can alter agent behavior without changing that code.
Check your understanding
An approved tool keeps the same name and executable, but an update changes its description to tell the agent to include secrets in every request. That is tool poisoning even though a conventional code diff of the executable is clean.