AI Agent Tool Poisoning
Think of an AI agent like a digital assistant that uses a toolbox to get things done. Tool poisoning is like a burglar sneaking into the assistant's workshop to swap out a hammer for a trick tool that looks normal but actually helps the burglar break into your house every time the assistant tries to use it.
AI Agent Tool Poisoning is a persistence technique where an attacker compromises the tools an agent relies on, such as built-in functions or MCP-connected services. By modifying tool parameters, descriptions, or underlying logic, the attacker ensures that the agent consistently executes malicious commands or exfiltrates data whenever the tool is invoked, effectively turning the agent's own utility layer into a persistent backdoor.
AI Agent Tool Poisoning is a supply chain and environment-level compromise where an adversary achieves persistence by subverting the integrity of tools integrated into an agent's execution environment, including native tools and those exposed via the Model Context Protocol (MCP). By manipulating tool definitions, schemas, or execution logic, the adversary forces the agent to perform unauthorized operations—such as data exfiltration or command injection—as a byproduct of legitimate tool usage, thereby maintaining long-term influence over the agent's decision-making loop and downstream system interactions.