{
  "id": 19415599,
  "title": "Tool poisoning in MCP, walked through with a lab you can run",
  "url": "https://urgent.news/2026/11/10/tool-poisoning-in-mcp-walked-through-with-a-lab-you-can-run",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T23:54:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/dev_bek/tool-poisoning-in-mcp-walked-through-with-a-lab-you-can-run-o2f"
  },
  "original_language": "en",
  "account": "An MCP server lists its tools to clients, providing a name, description and input schema. Tool poisoning occurs when the description contains instructions or commands intended for the model, rather than describing the tool's function. Invariant Labs detailed the pattern in April 2025 and named it a Tool Poisoning Attack. The example provided has the model instructed to read a file and pass its contents to the tool, which is malicious. The server receives data provided by the model according to the hidden instruction. A client may approve the call without noticing the hidden parameters. Attack success rates have been reported at 72.8%. META-01, a detection tool, looks for indicators of tool poisoning such as markup, model-targeted language, requests for sensitive data, and hidden Unicode characters in the descriptions. It is passive and does not call the tool, but serves as a heuristic to catch suspicious descriptions.",
  "summary": "Originally published at mcpprobe.tech . This is a hands-on walkthrough of one attack: a tool whose description carries instructions for the model. You will see a minimal poisoned tool, why it works, how mcpprobe's META-01 check flags it, what the fixed version looks like, and a lab you can run locally in a minute. For the wider family of payloads (shadowing, hidden Unicode), see our payload…",
  "key_points": [
    "Tool poisoning involves malicious instructions in tool descriptions",
    "Attack success rate of 72.8% reported by Invariant Labs",
    "META-01 detection tool identifies suspicious tool descriptions"
  ],
  "editors_take": "Exploiting tool descriptions to manipulate model behavior bypasses traditional client approvals, forcing developers to adopt heuristic detection tools to identify malicious instructions hidden within server schemas.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}