Tool Description Poisoning
Tool description poisoning is an attack where malicious instructions are embedded in an MCP tool's description field, causing the agent to invoke the tool in an attacker-intended way or to misinterpret the tool's purpose.
Why this matters for AI agents
Tool descriptions are LLM-readable metadata that shapes how agents use tools. An attacker who can modify a tool description can influence agent behavior without touching the agent code.
How AgntID relates
AgntID monitors tool descriptions and can detect anomalous changes or patterns in tool schemas that indicate description poisoning, blocking calls to tools with tampered metadata.
The static IAM gap
IAM does not inspect tool descriptions. It has no awareness of the semantic content of tool metadata and cannot detect description-level manipulation.
Related phrases
Frequently asked questions
What is tool description poisoning?
Tool description poisoning is an attack where malicious instructions are embedded in an MCP tool's description field, causing the agent to invoke the tool in an attacker-intended way or to misinterpret the tool's purpose.
Why are tool descriptions a meaningful attack surface?
Tool descriptions are LLM-readable metadata that shapes how agents use tools. An attacker who can modify a tool description can influence agent behavior without touching the agent code.
How does AgntID detect tool description poisoning?
AgntID monitors tool descriptions and can detect anomalous changes or patterns in tool schemas that indicate tampering, blocking calls to tools whose descriptions have been modified.
Secure every agent tool call at execution time.
AgntID gives infrastructure teams scoped, ephemeral access control for AI agents without replacing IAM, MCP servers, tools, or agent frameworks.