工具投毒
MCP协议中的一种攻击手法，指在工具描述文本中夹带用户界面不可见的恶意指令，模型将描述当作指令读取从而执行非预期操作
Core Facts
Supply-chain-level MCP attack patterns include typosquatted servers and rug pulls (i.e., tool definitions that are silently altered after being approved).
Tool poisoning refers to embedding malicious instructions in tool description text that are invisible to humans but interpretable by AI, inducing agents to perform unintended actions.
Timeline (last 90 days)
The MCP ecosystem is still in its early stages and lacks mature signing, permission declaration, and auditing standards; third-party MCP server origins are hard to verify, and tool descriptions may be maliciously tampered with to induce model invocation (i.e., "tool poisoning").
Invariant Labs在2025年4月1日首次将描述中夹带客户端界面不可见指令的现象命名为'工具投毒'（tool poisoning）。
恶意指令抵达模型有两条路径：一是工具描述本身（工具投毒），二是服务器实现代码中的行为（如postmark-mcp的BCC隐藏在邮件API实现里）。
Supply-chain-level MCP attack patterns include typosquatted servers and rug pulls (i.e., tool definitions that are silently altered after being approved).
Tool poisoning refers to embedding malicious instructions in tool description text that are invisible to humans but interpretable by AI, inducing agents to perform unintended actions.
All Facts (5)
Supply-chain-level MCP attack patterns include typosquatted servers and rug pulls (i.e., tool definitions that are silently altered after being approved).
65%VerifiedTool poisoning refers to embedding malicious instructions in tool description text that are invisible to humans but interpretable by AI, inducing agents to perform unintended actions.
65%UnverifiedThe MCP ecosystem is still in its early stages and lacks mature signing, permission declaration, and auditing standards; third-party MCP server origins are hard to verify, and tool descriptions may be maliciously tampered with to induce model invocation (i.e., "tool poisoning").
50%UnverifiedInvariant Labs在2025年4月1日首次将描述中夹带客户端界面不可见指令的现象命名为'工具投毒'（tool poisoning）。
50%Unverified恶意指令抵达模型有两条路径：一是工具描述本身（工具投毒），二是服务器实现代码中的行为（如postmark-mcp的BCC隐藏在邮件API实现里）。
50%