---
title: Tool Poisoning Attacks in LLM Agents
url: https://www.emergentmind.com/topics/tool-poisoning-attacks-tpa
type: topic
---

# Tool Poisoning Attacks in LLM Agents

A Tool Poisoning Attack (TPA) is a class of adversarial manipulation against tool-augmented large language model (LLM) agents operating under protocols such as the Model Context Protocol (MCP). In TPA, an adversary injects malicious, covert instructions into the natural-language metadata or structured descriptors (e.g., JSON definitions) of tools, which are then trusted and internalized by the LLM’s planning components. These attacks are distinct from direct prompt injection and code-embedded poisoning, leveraging the agent’s assumption of descriptor truthfulness to induce unauthorized behavior, exfiltration, denial-of-service, or persistent compromise of the agentic control flow. TPAs fundamentally exploit the semantic gap between protocol-level integration and language-model reasoning, introducing critical vulnerabilities at the intersection of metadata, tool selection, and execution autonomy.

## 1. Formalization and Taxonomy in the MCP Ecosystem

TPAs are fundamentally indirect prompt-injection attacks targeting the agent’s context, rather than explicit user inputs or tool code. Let a tool definition be $T = (m, p)$ with $m \in \mathcal{M}$ representing metadata (including name and description), and $p \in \mathcal{P}$ encoding the parameter specification. A poisoning attack is defined by a mapping $\mathrm{poison}: \mathcal{M} \to \mathcal{M}_{\mathrm{adv}}$ such that $m_{\mathrm{adv}} = \mathrm{poison}(m)$ causes the policy $\pi_\theta(\mathrm{user\_query}, \{m, T\}) \to \mathrm{action}$ to deviate from intended service behavior [2603.22489].

Main TPA categories in current literature include:
- **File/credential exfiltration:** embedding directives to read sensitive files such as `~/.ssh/id_rsa`.
- **Unsanctioned tool invocation:** enforcing “priority” or forced ordering on surveillance/logging tools.
- **Parameter tampering:** hidden instructions to rewrite arguments, e.g., rerouting email recipients.
- **Remote command execution (RCE):** directives to invoke shell commands via legitimate tool interfaces.
- **Phishing via UI:** embedding Markdown links or hidden URLs in tool output.
- **Implicit poisoning:** metadata of a dormant or never-invoked tool biases the invocation policy toward unanticipated, privileged tools [2601.07395].

## 2. Threat Models, Attack Workflow, and Benchmarks

The canonical MCP threat model assumes that the agent automatically ingests tool metadata at registration, trusting the fields as authoritative. The adversary typically controls or registers tools via a compromised or malicious MCP server, supplying crafted descriptors with covert instructions [2608.14925].

In TPA, the manipulated tool description is injected into $p_{\mathrm{desc}} \subset p_{\mathrm{system}}$. The agent’s reasoning over tool selection and sequencing is then influenced by the poisoned metadata, leading to execution of attacker-desired actions through otherwise legitimate external tools. Unlike behavior-based attacks, TPA affects the agent prior to any tool execution, rendering behavior-level defenses fundamentally insufficient [2508.20412].

**Empirical characterization:**
- MCPTox, the first large-scale TPA benchmark, evaluates attacks on 45 real MCP servers and 353 tools, enabling 1,312 malicious test cases spanning privacy leakage, parameter tampering, credential exfiltration, hijacking, and more [2508.14925].
- Models with stronger instruction-following capability (e.g., o1-mini, GPT-4o) are systematically more susceptible, with attack success rates (ASR) at 72.8% (o1-mini) and 58.5% (Qwen3-32B w/CoT), while conservative models (Claude-3.7-Sonnet) display only 34.3% [2508.14925].
- Highly stealthy TPAs (e.g., implicit attacks) remain largely undetectable even to state-of-the-art safety alignment mechanisms and dedicated detectors [2601.07395].

## 3. Stealth Techniques and ShareLock: Multi-Tool Threshold Poisoning

Early TPAs utilized plaintext embedding within a single tool descriptor, but these are increasingly detectable by static, content-based and LLM-driven vetting. ShareLock introduces a cryptographically-stealthy, multi-tool threshold poisoning scheme [2606.27027]:

- **Payload splitting:** The malicious instruction $P_{\mathrm{adv}}$ is partitioned into fragments, encoded as field elements $N_j$ over a prime field $\mathbb{F}_p$.
- **Shamir’s scheme:** For each $N_j$, a random polynomial $f_j(x)$ of degree $t-1$ is constructed. Shares $s_{i,j} = f_j(x_i) \bmod p$ are then computed and distributed across $n$ tools via innocuous metadata fields (e.g., `checksum`).
- **Covert trigger:** An additional tool is registered with a covert trigger (“EnvSetup”) instructing the agent to reconstruct $P_{\mathrm{adv}}$ via Lagrange interpolation only when $t$ or more shares are available at runtime.
- **Stealth property:** Information-theoretic secrecy ensures that $r < t$ shares reveal zero mutual information about the payload, making individual tool vetting ineffectual. Entropy analysis demonstrates that the blended tool descriptors are statistically indistinguishable from benign high-entropy tokens (Shannon entropy 5.22 bits/char vs. 5.02 bits/char for benign) [2606.27027].

**Evaluation:** 
- ShareLock achieves ASR $\approx$94%, task completion $>$96%, with attack stealth effectiveness (ASE) $\approx$95%. It strictly outperforms single-tool attacks (Encode-Only max 82.7% ASR), and is resilient to simulated tool auditing and moderate removal, maintaining ASR $>$90% as long as the threshold is met [2606.27027].

## 4. Detection, Attribution, and Defense Mechanisms

Traditional behavior-based monitoring (e.g., runtime provenance, output comparison) is ineffective against TPA, especially the implicit variants, since compromised tool need not be executed and behavioral traces are absent [2508.20412]. Proposals for mitigation include:

- **Decision Dependence Graphs (DDG):** MindGuard uses attention-based reasoning graphs where vertices are high-level concepts (user query, all tools, past invocations), and edges are attention-derived dependencies. Anomaly scores such as the Anomaly Influence Ratio (AIR) can efficiently detect and attribute poisoned influences, achieving 94–99% detection precision and 95–100% attribution accuracy with negligible latency [2508.20412].
- **Isolated Planning (Tool-Guard):** When misaligned or suspicious behavior is detected, affected tools are quarantined into an “influenced list,” decoupling their context from the rest of the tool set. This system-level wrapper brings the ASR for cross-tool poisoning down from 43.3% (no defense) to 2.06% (Tool-Guard) while preserving task utility [2606.20922].
- **Protocol-level hardening:** Requiring rigorously typed metadata, restricting custom fields (e.g., “checksum”), enforcing mutual consistency, cryptographically signing tool descriptors, and runtime confirmation for second-stage triggers [2512.06556, 2606.27027].
- **Multi-layered defense:** Static metadata analysis (regex, JSON schema checking), decision/path tracking, anomaly detection (e.g., Mahalanobis distance on call features), and transparency-enhancing user UIs comprise a defense-in-depth stack [2603.22489].

## 5. Variants: Memory Poisoning and Implicit Attacks

Beyond the canonical attack surface of tool metadata, memory poisoning has emerged as a potent TPA vector. MemMorph demonstrates that injecting a minimal number of crafted, benign-looking records into the persistent memory of an LLM agent can efficiently bias future tool selection, even after self-reflection or context filtering [2605.26154]. Key findings:

- Memory poisoning achieves up to 85.9% ASR (as compared to $<$40% for prompt-only baselines), and remains effective under memory growth and weak defenses.
- Typical mitigation approaches, such as perplexity filters, shallow classifiers, and LLM auditors, cannot fully block memory-level attacks.

Implicit tool poisoning, as automated by MCP-ITP, constructs poisoned metadata that is never directly invoked but manipulates the agent to call privileged tools. Adaptive black-box optimization combines attack success with detector evasion, reaching an ASR up to 84.2% with malicious tool detection rates as low as 0.3% across twelve LLM agents [2601.07395].

## 6. Empirical Benchmarks and Systemic Impact

Comprehensive sandboxes and security benchmarks such as MCPTox and MCP-TDP quantify systemic agentic vulnerability: high-fidelity experiments verify that nearly all widely used models (GPT-4o, Gemini, Claude) are susceptible to TPA, with baseline attack rates approaching 100% in high-risk scenarios (command execution, file tampering, privilege escalation) [2608.14925, 2605.24069].

Key findings:
- Simple content moderation, prompt guardrails, and output token filtering are largely ineffective; in some cases, they paradoxically boost attack success (the “Firewall Fallacy”) [2605.24069].
- Post-execution anomaly detection (“Reactive Self-Correction”) demonstrates limited success (e.g., Claude and DeepSeek recover from $>$80% of detectable anomalies), but the primary attack almost always succeeds before correction [2605.24069].
- Stronger instruction-following capacity implies elevated risk (“paradox of capability”): better-aligned models more reliably internalize adversarial metadata [2508.14925].

## 7. Open Challenges, Future Directions, and recommendations

The evolution of TPA, notably cryptographically-distributed payloads (ShareLock), persistent memory attacks (MemMorph), and black-box adaptive poisoning (MCP-ITP), highlights the escalation of adversary sophistication.

Emergent defense directions include:
- **Protocol-level cryptographic validation:** RSA-based manifest signing prevents post-approval descriptor tampering (“rug pull”), but introduces latency and operational cost [2512.06556].
- **Semantic vetting via auxiliary LLMs:** LLM-on-LLM safety screening outperforms static regex but incurs higher latency; combined defense stacks reach 72.2% block rate against poisoning [2512.06556].
- **Cross-tool and cross-metadata auditing:** Dynamic, context-aware tools that aggregate and correlate multiple sources of metadata or evince semantic relationships (e.g., multi-tool overlays, inter-tool dependency graphs) are necessary to defeat threshold and distributed attacks [2606.27027].
- **Memory module provenance tracking and consistency checks:** Robust, cryptographically attested memory ingestion pipelines are required to block the memory poisoning surface [2605.26154].

Ongoing open research topics involve adversarial training for robust verifiers, formal guarantees for semantic descriptor integrity under compositional attack, decentralized validation, and scalable, low-latency certification of agent tool-calling [2602.09757]. The need to integrate proactive semantic sanitization, real-time behavioral profiling, and reactive self-healing is emphasized as essential for securing autonomous LLM agent infrastructures in adversarial environments.

---

**References**:  
[2508.14925] MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers  
[2606.27027] ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP  
[2508.20412] MindGuard: Tracking, Detecting, and Attributing MCP Tool Poisoning Attack via Decision Dependence Graph  
[2606.20922] Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning  
[2603.22489] Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning  
[2605.26154] MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning  
[2601.07395] MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP  
[2512.06556] Securing the Model Context Protocol: Defending LLMs Against Tool Poisoning and Adversarial Attacks  
[2605.24069] When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents

Source: https://www.emergentmind.com/topics/tool-poisoning-attacks-tpa